HPHardwareDiagnostics-PoC

HPHardwareDiagnostics-PoC 针对 HP Hardware Diagnostics 的 EtdSupp 驱动程序的 PoC 漏洞利用 CVE-2023-32673/PSR-2022-0209 构建 在 Visual Studio 2019 中打开 以 Release 模式构建 欣赏（或者不） 摘要 一个非常简单的小驱动程序，具备虚拟内存读写功能，没有 MmMapIoSpace 等。 免责声明 无糖汽水很难喝。...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Use VMMAP instead of VMALLOC for the ringbuf area. After the commit 2fd3fb0be1d1 “kasan, vmalloc: unpoison VMALLOC pages after mapping”, non-VMALLOC mappings will be marked as accessible in getvmareanode when KASAN is enable...

Astra Linux – Vulnerability in Linux

A issue was discovered in Linux: improper handling of VMIO|VMPFNMAP vmas in KVM can bypass RO checks and cause pages to be freed while still accessible by the VMM and guest. This allows users who have the ability to start and control a VM to read/write random pages of memory, potentially leading ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: powerpc/fixmap: Fixed the VM debug warning when unmapping a fixmap entry. The unmapping of a fixmap entry is performed by calling setfixmap, with FIXMAPPAGECLEAR as the flag. Currently, powerpc setfixmap calls mapkernelpage...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

A issue was discovered in include/asm-generic/tlb.h in the Linux kernel before version 5.19. Due to a race condition between unmapmappingrange and munmap, a device driver can free a page while it still has stale TLB entries. This only occurs in situations involving VMPFNMAP VMAs...

Linux Distros Unpatched Vulnerability : CVE-2026-72357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong...

CVE-2026-68101

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. During the allocation or deallocation of a user pointer buffer object, a critical reference to its virtual memory object can become unavailable. This improper handling of memory submissions could lead to system instability or a denial ...

CVE-2026-68275

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68265

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

CVE-2026-68264

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: Reset currentop in xeptupdateopsinit xeptupdateopsinit fails to reset currentop to 0. On the vmbind path, opsexecute calls xeptupdateopsprepare inside the xevalidationguard / drmexecuntilalllocked loop. When that loop...

CVE-2026-68260

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68166

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...

CVE-2026-68275 drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check amdgpuvmbofind result in GETMAPPINGINFO The AMDGPUGEMOPGETMAPPINGINFO path of amdgpugemopioctl looks up the bova for the buffer object in the caller's VM via amdgpuvmbofind, but uses the returned pointer without...

CVE-2026-68265

CVE-2026-68265 affects the Linux kernel, specifically the drm/xe/vm path. The issue arises when prefetching a BO VMA in the region DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC, where the code uses the value as an index into region_to_mem_type[], causing an out-of-bounds access (value is -1). The remediatio...

CVE-2026-68265 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix BO prefetch with CONSULTMEMADVISEPREFLOC When prefetch region is DRMXECONSULTMEMADVISEPREFLOC for a BO VMA, the code used it as an index into regiontomemtype, causing an out-of-bounds access since the value is -1...

CVE-2026-68260 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: acquire vmctx-lock before mapping memory to GPU VM The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is...

CVE-2026-68166 userfaultfd: prevent registration of special VMAs

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: prevent registration of special VMAs Vova Tokarev says: userfaultfd allows registration on shadow stack VMAs. With userfaultfd access, you can register on the shadow stack, discard a page ... and inject a page with...

EUVD-2026-55482

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpuhmminvalidategfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo-vmbo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can alwa...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

TencentOS Server 3: dovecot (TSSA-2026:0810)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0810 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...