CVE-2026-64582

The CVE concerns a race in the Linux kernel RDMA/rxe path, specifically in rxe_mmap. A use-after-free can occur when rxe_mmap_info is removed from pending_mmaps while its kref is not yet released, due to a concurrent DESTROY_CQ ioctl. The race between vmalloc range remapping and freeing vmalloc-e...

Exploit for Improper Check for Unusual or Exceptional Conditions in Samsung Android

--- CVE-2026-21007 – GPU Driver ioctl Race Condition Kernel...

kernel: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

A flaw was found in KVM in the Linux kernel. This vulnerability occurs due to improper validation of memory management unit MMU page roots after these pages are made available. An attacker could exploit this by triggering a scenario where KVM attempts to map memory into an invalid root, causing...

CVE-2026-64300

A flaw was found in the Linux kernel's perf/aux subsystem. A use-after-free UAF vulnerability exists in the maprange function due to a race condition. This can occur when two performance events share a ring buffer, allowing a local attacker to map a memory page that has already been freed...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2025-39845)

In the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCHPAGETABLESYNCMASK and archsynckernelmappings Define ARCHPAGETABLESYNCMASK and archsynckernelmappings to ensure page tables are properly synchronized when calling pdpopulatekernel. For 5-level paging,...

SUSE CVE-2026-64349

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix dwc3readl and dwc3writel calls in dwc3ulpisetup The dwc3ulpisetup calls the register read and write calls with dwc3-regs when both these calls take the dwc3 structure directly. Chnage these two calls to fix the...

CVE-2026-16280 GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in...

PT-2026-64102

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image. MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImaging MapBuffer src/map.c. The per-row spacing strid...

Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Summary When Pillow loads an uncompressed image whose tile uses the raw codec and a mode in Image.MAPMODES, and the image was opened from a filename, it memory-maps the file and builds the image's row pointers directly into the mapping via PyImagingMapBuffer src/map.c. The per-row spacing stride ...

CVE-2026-63807

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 memory management unit MMU. A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead t...

CVE-2026-64051

A flaw was found in the Linux kernel's accel/qaic driver. This vulnerability allows for memory to be mapped beyond its intended boundaries during certain memory allocation operations. A local attacker could exploit this flaw, leading to a use-after-free condition. This could potentially result in...

BIT-PILLOW-2026-54058 Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes, getpixel,...

SUSE CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

CVE-2026-63950

Summary: CVE-2026-63950 pertains to the Linux kernel mm/rmap path. The issue arose from not reinitializing nr_pages at the start of each loop in try_to_unmap_one, allowing a value from a previous folio_unmap_pte_batch() to be reused in a later iteration. This could cause corruption of folio refco...

CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

CVE-2026-63807

CVE-2026-63807 concerns the Linux kernel KVM: x86/mmu path. The issue arises when recovering hugepages in the shadow MMU, where the base guest frame number (gfn) of a shadow page must be verified to be within the target memslot before querying the max mapping level. If the gfn is not pre-checked,...

CVE-2026-53401

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

EUVD-2026-45456

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfbmmap omapfbmmap has a race condition with OMAPFBSETUPPLANE ioctl that can lead to use-after-free: The fbmmap entry point holds mmlock but not lock fbinfo-lock, while ioctl handlers like...

CVE-2026-53401

The CVE-2026-53401 vulnerability affects the Linux kernel fbdev omap2 driver (omapfb_mmap) with a race between mm_lock and fb_info->lock when mapping memory via OMAPFB_SETUP_PLANE. The race can lead to a use-after-free by reading start/len from mismatched region references and incrementing an ...

CVE-2026-53373

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmapprepare invoked from mmap The mmapprepare hook functionality includes the ability to invoke mmapprepare from the mmap hook of existing 'stacked' drivers, that is ones which are capable of...