CVE-2024-38041

CVE-2024-38041 커널 포인터가 appid.sys 드라이버의 ioctl 0x22A014를 통해 출력 사용자 모드 버퍼에 복사됩니다...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore 領域外読み取り（KASLR 無効化） コンポーネント: AppleKeyStore カーネル拡張 — LibSerSEPControlDeserialize 影響を受けるバージョン: iOS / iPadOS 26.6 23G71 以前 修正バージョン: iOS / iPadOS 26.6.1 23G83 種別: SEP 制御メッセージ逆シリアル化における領域外読み取り 影響: カーネルポインタ漏洩 → サンドボックス化された権限不要プロセスからの KASLR 無効化（DYLDINTERPOSE ACM ハンドル取得経由）...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

CVE-2026-20805-PoC

CVE-2026-20805 PoC Microsoft Desktop Window Manager（dwm.exe）における情報漏えいの脆弱性を実証するProof of Conceptです。 概要 このリポジトリには、Windows Desktop Window Managerプロセスに影響を与える情報漏えいの脆弱性であるCVE-2026-20805を再現するために開発されたカスタムProof of...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1719231016)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1719231016 advisory. - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: 데스크톱 힙에 하나의 QWORD가 너무 많음 Windows 11 Insider 빌드 10.0.28020.2149에서 Win32k 데스크톱 힙의 사용자 모드 매핑이 오프셋 0x100에 원시 커널 세션 풀 포인터를 노출했습니다. 읽기 자체는 거의 공격적으로 작을 정도입니다: ULONG64 leaked = ULONG64 desktopheap + 0x100; 테스트 세션에서 다음 값이 반환되었습니다: 0xffffc600dcc00040 이 값은 동일한 데스크톱의 프로세스 간에 동일하게 유지되었으며 재부팅 후...

Linux Distros Unpatched Vulnerability : CVE-2026-90220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.p...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220

CVE-2026-90220 is a kernel pointer leak in the Linux kernel's ALSA: seq subsystem. The function bounce_error_event() embeds a failed event into the bounce payload by pointing data.ext.ptr at it. For queued variable-length events, this pointer holds the kernel address of the first extension cell (...

EUVD-2026-81813

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed incorrect reg type conversion in releasereference Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release this memory by calling the corresponding helper...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007loadencoder In go7007loadencoder, the variable bounce i.e., go-bootfw is allocated without subsequent deallocation. After the following call chain: saa7134go7007init | | - go7007bootencoder |...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: advansys: Fixed kernel pointer leaks Pointers should be printed using %p or %px, rather than being cast to unsigned long and then printed using %lx. Change %lx to %p when printing hashed pointers...

Astra Linux – Vulnerability in Linux 5.10

The checkaluop function in kernel/bpf/verifier.c in the Linux kernel, as of v5.16-rc5, did not properly update the bounds when handling the mov32 instruction. This issue allows local users to obtain potentially sensitive address information, also known as a “pointer leak.”...

Linux Distros Unpatched Vulnerability : CVE-2026-80918

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the...

CVE-2026-80918

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80918

CVE-2026-80918 is a type-confusion bug in the Linux kernel HID core subsystem. When hid_scan_report() calls fetch_item() on an item tagged HID_ITEM_TAG_LONG, the data is stored as a pointer in item->data.longdata rather than as a value. However, item_udata() and item_sdata() assume the item is...

CVE-2026-80918 HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...