PT-2026-76715

The flash copy system call is verified by z vrfy flash copy in drivers/flash/flash util.c. On builds with CONFIG USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer K SYSCALL MEMORY WRITE and passed the two...

Design/Logic Flaw

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment TEE modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure superviso...