qemu-colo-l4-oob

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · qemu-colo-l4-oob qemu-colo-l4-oob QEMU v11.1.2 4fc49f46dc95d4a27de2509e7fceb2931e91faeb - COLO filter-rewriter Class: OOB heap buffer overflow READ/WRITE. Reach: Local guest / Remote COLO peer. parsepacketearly accept...

CVE-2026-80861

A flaw was found in the Linux kernel's USB eXtensible Host Controller Interface xHCI driver. When an xHCI host controller is inaccessible during its setup process, the driver attempts to read from an incorrectly calculated memory address. This unaligned memory access can cause a kernel panic,...

CLSA-2025-1746479711 kernel-uek: Fix of 225 CVEs

sctp: sysctl: authenable: avoid using current-nsproxy - sctp: sysctl: cookiehmacalg: avoid using current-nsproxy CVE-2025-21640 - bpf: Use preemptcount directly in bpfsendsignalcommon - Revert "sctp: sysctl: cookiehmacalg: avoid using current-nsproxy" - jfs: fix slab-out-of-bounds read in eaget -...

CLSA-2026-1777614769 kernel: Fix of 18 CVEs

crypto: algifaead - Fix minimum RX size check for decryption - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use...

Astra Linux – Vulnerability in Qemu

QEMU 5.0.0 has a use-after-free issue in the hw/usb/hcd-xhci.c file, as the return value of usbpacketmap is not checked...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: xhci: A memory leak was fixed in xhcidisableSlot. xhcialloccommand allocates a command structure. When the second argument is true, it also allocates a completion structure. Currently, the error handling code in...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: usb: host: xhci: Fixed a potential memory leak in xhciallocstreaminfo The xhciallocstreaminfo function allocates a stream context array for streaminfo-streamctxarray using xhciallocstreamctx. When an error occurs, the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fixed an issue where unregister was called again after module exit due to a failure in ttyregisterdriver. If ttyregisterdriver fails, it releases the reference, but fails to set dbcttydriver to NULL, causing...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq Cannot set @sharedhcd to NULL before decreasing the usage count via usbputhcd; this causes the shared hcd to remain in use...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: 167.057718 BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 167.057872...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Error handling was added in xhcimapurbfordma. Currently, xhcimapurbfordma creates a temporary buffer and copies the SG list to the new linear buffer. However, if kzallocnode fails, the call to sgpcopytobuffer may lead ...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: fixed the issue where lost bounce buffers occur when TDs span several ring segments. When a TD reaches a link TRB with data that is not aligned with the endpoint’s wMaxPacketSize, the xhciAligntd function stages the unalign...

CVE-2026-101309

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309

The bhyve hypervisor contains a race condition in its xHCI (USB 3) device model. The model fails to validate or save the event ring size provided by the guest, re-reading it from guest memory on each use. Furthermore, Transfer Request Block (TRB) fields are loaded without protection against concu...

CVE-2026-101309 Multiple vulnerabilities in bhyve device models

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

EUVD-2026-101932

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

CVE-2026-101309: Concurrent Execution using Shared Resource with Improper Synchronization

The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded without protection against concurrent modification by the guest. This race condition could be...

PT-2026-114820

Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The xHCI USB 3 device model fails to validate or save the event ring size provided by the guest. Because the size is re-read from guest memory during each use, Transfer Request Block TRB fields...