216 matches found
win32k-callback-detouring
Disclaimer This repository is provided strictly for educational and defensive research purposes. It demonstrates Windows internal callback dispatch mechanics and KernelCallbackTable-related control-flow concepts in a proof-of-concept context. Not intended for unauthorized use Not designed for...
PT-2026-121880
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy to user failure If kfd dbg trap enable fails while copying runtime info to userspace, it had already activated the trap, set debug trap enabled, taken an extra process reference, and...
PT-2026-115453
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the role parameter handled by the wppb add meta to user on activation function. The vulnerabili...
Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for UltraSPARC The referenced commit introduced exception handlers on user-space memory references in copyfromuser and copytouser. These handlers return from the respectiv...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: sparc: Fixed inaccurate exception reporting in copyfromtouser for UltraSPARC III. Anthony Yznaga identified a bug in the ext4 code where, when large folios were enabled, copyfromuser returned impossibly large values, ones that...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed a double-free in rxesrqfrominit. In rxesrqfrominit, the queue pointer q is assigned to srq-rq.queue before copying the SRQ number to user space. If copytouser fails, the function calls rxequeuecleanup to free the...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: cachefiles: The exposure of the anonymous file descriptor is deferred until after copytouser succeeds. After installing the anonymous file descriptor, we can now see it in userland and close it. However, at this point we may not...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: hwrng: core – Fix page fault deadlock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This occurs when the user reads from /dev/hwrng into memory, and at the same time, /dev/hwrng is also mapped into memory...
PT-2026-114375
In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch exit to user mode prepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR KUAP BLOCKED. While returning to userspace just before RF...
Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data in case of failure. Also, wipe sensitive data from the stack if the copytouser function fails...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock issue with buffermutex and mmaplock The syzbot tool detected a potential deadlock between the runtime-buffermutex and the mm-mmaplock. This issue arose due to the recent fix related to racy...
CVE-2026-72441 ieee802154: fix kernel-infoleak in dgram_recvmsg()
In the Linux kernel, the following vulnerability has been resolved: ieee802154: fix kernel-infoleak in dgramrecvmsg KMSAN reported a kernel-infoleak in moveaddrtouser: BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:131 inline BUG: KMSAN: kernel-infoleak in...
CVE-2026-68369
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: printer: fix infinite loop in printerread printerread uses the same variable for the requested copy size and the number of bytes actually copied to user space. copytouser returns the number of bytes not copied, so wh...
CVE-2026-68369
The CVE affects the Linux kernel USB gadget printer driver (printer_read) where the code used the same variable for the requested copy size and the actual copied bytes. If copy_to_user fails to copy anything, the copied length becomes zero and RX data can cause an infinite loop because len/buf/cu...
CVE-2026-64290
A flaw was found in the Linux kernel's iommufd component. When a copytouser operation fails within the iommufdfaultfopsread function, the system enters an infinite loop. This continuous retry consumes 100% of the CPU and holds a mutex, which can lead to a denial of service DoS for affected system...
SUSE CVE-2026-64290
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
UBUNTU-CVE-2026-64290
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290 iommufd: Break the loop on failure in iommufd_fault_fops_read()
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...
CVE-2026-64290
CVE-2026-64290 affects the Linux kernel via iommufd_fault_fops_read(): on a copy_to_user() failure inside the inner loop, only the inner loop breaks, causing the outer loop to retry indefinitely and spin the reader with fault->mutex held. The public fixes implement breaking the outer while by ...