CVE-2026-97953

A flaw was found in the Linux kernel's stmmac network driver. An attacker can cause a Denial of Service DoS by transmitting highly fragmented network packets that use TCP Segmentation Offload TSO. Due to an improper calculation of required transmit descriptors, the driver writes past available...

SUSE CVE-2026-97617

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resizedisabled before publishing the new subbuf order ringbuffersubbuforderset stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer has...

CVE-2026-97617

A flaw was found in the Linux kernel's ring buffer subsystem. A race condition occurs when updating the buffer configuration concurrently with memory mapping operations. Because the kernel applies the new buffer order before verifying that resizing is permitted across all processors, the system c...

CVE-2026-97573

A flaw was found in the Linux kernel's Broadcom NetXtreme-E bnxten network driver. The driver fails to verify memory allocation success during receive ring buffer resets, ignoring failure responses when memory is low. A local user or network event that triggers a reset under memory exhaustion can...

CVE-2026-97572

A flaw was found in the Linux kernel's Broadcom NetXtreme bnxten network driver. This flaw can result in a Denial of Service DoS or memory corruption when the device is initialized or reset under low-memory conditions. The driver ignores memory allocation errors during receive ring buffer setup a...

CVE-2026-98057

A flaw was found in the Linux kernel's tracing ring buffer. The persistent ring buffer validation logic fails to verify that the recorded sub-buffer count matches the expected page count in the metadata. A local attacker capable of manipulating persistent memory metadata could exploit this issue ...

CVE-2020-11179-Adreno-Qualcomm-GPU

Моя самостоятельная работа на основе PoC, созданного исследователем P0 Беном Хоуксом Оригинальная статья: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html Моя цель — перевести его PoC на C и продолжить с того места, где он остановился, и превратить PoC либо в...

qiomem

Описание Произвольное чтение/запись физической памяти с использованием Toshiba qiomem.sys из ring 3 работает только с физическими адресами до 4 ГБ. Драйвер распространяется через Microsoft Update Catalog. Другие варианты. Не указан в Microsoft Vulnerable Driver List, ранее CVE не присваивался...

CVE-2021-4204

CVE-2021-4204 Китайский разбор: https://tr3e.ee/posts/cve-2021-4204-linux-kernel-ebpf-lpe.txt Только для образовательных/исследовательских целей. Используйте на свой страх и риск. Сборка и запуск $ sh buildandrun.sh Build from source... cc -I include -static -w -o exploit exploit.c Start exploit!...

CVE-2022-24611

CVE-2022-24611 Z-Wave S0-No-More攻撃の詳細。この攻撃の仕組みと調査結果を再現する方法についての完全な分析とレポートは、添付のPDFファイルを参照してください。 簡単な説明: S0およびS2デバイスに対するサービス妨害DoS攻撃Z-Wave ZW5xx製品ラインでテスト済み。具体的には、Z-Wave対応のAmazon Ring Gen. 1デバイスが対象です。攻撃者はS0...

DEBIAN-CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

AZL-104181 CVE-2026-97997 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

DEBIAN-CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

DEBIAN-CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

AZL-104517 CVE-2026-97953 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

DEBIAN-CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97617

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resizedisabled before publishing the new subbuf order ringbuffersubbuforderset stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer has...

DEBIAN-CVE-2026-97617

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Check resizedisabled before publishing the new subbuf order ringbuffersubbuforderset stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer has...