CVE-2026-0010
published 2026-03-02CVE-2026-0010: In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.12%
1.9th percentile
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-73wv-jfxj-49v9: In onTransact of IDrmManagerService
ghsa_unreviewed·2026-03-02
CVE-2026-0010 [HIGH] CWE-787 GHSA-73wv-jfxj-49v9: In onTransact of IDrmManagerService
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Red Hat
kernel: bpf: Fix divide-by-zero in btf_struct_walk()
vendor_redhat·2026-10-18·CVSS 4.4
CVE-2026-98647 [MEDIUM] CWE-369 kernel: bpf: Fix divide-by-zero in btf_struct_walk()
kernel: bpf: Fix divide-by-zero in btf_struct_walk()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix divide-by-zero in btf_struct_walk()
When an access goes past the struct and the last member is a flexible
array, btf_struct_walk() folds the offset back into a single element with
(off - moff) % t->size, but never checks that the element type has a size.
BTF takes an empty struct, so this in program BTF
/* event could be empty */
struct event {
#ifdef HAVE_TIMESTAMP
__u64 ts;
#endif
};
struct batch {
int nr;
struct event events[];
};
divides by zero at prog load time. Getting there needs a PTR_TO_BTF_ID that
is not MEM_ALLOC, e.g. a plain read of a local kptr stashed in a map from a
sleepable program.
Oops: divide error: 0000 [#1] SMP KASAN PTI
RIP: 0010:btf_st
Red Hat
kernel: drm/ttm: Drop tt->restore after successful restore
vendor_redhat·2026-09-16·CVSS 7.8
CVE-2026-89815 [HIGH] CWE-772 kernel: drm/ttm: Drop tt->restore after successful restore
kernel: drm/ttm: Drop tt->restore after successful restore
In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: Drop tt->restore after successful restore
ttm_pool_restore_and_alloc() can successfully complete the restore
process via ttm_pool_restore_commit(), but tt->restore is not dropped
afterward. As a result, subsequent backup/restore flows observe what
appears to be a completed restore, while in reality shmem handles are
still installed in tt->pages, leading to the stack trace below.
Fix this by freeing and dropping tt->restore in
ttm_pool_restore_and_alloc() upon successful completion of the restore.
20545 [ 309.784531] RIP: 0010:sg_alloc_append_table_from_pages+0x38c/0x490
20547 [ 309.809570] RSP: 0018:ffffc9000623b838 EFLAGS: 00010206
20548 [ 309.814827] RA
Red Hat
kernel: net/mlx5e: fix BQL reset on SQ re-activation
vendor_redhat·2026-08-22·CVSS 5.5
CVE-2026-74698 [LOW] CWE-617 kernel: net/mlx5e: fix BQL reset on SQ re-activation
kernel: net/mlx5e: fix BQL reset on SQ re-activation
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: fix BQL reset on SQ re-activation
mlx5e_queue_start() deactivates and re-activates all channels but closes
only the queue being restarted. mlx5e_activate_txqsq() then
unconditionally calls netdev_tx_reset_queue(), zeroing the BQL counters
of channels that kept their in-flight TX WQEs. The next completion then
over-charges and trips the BUG_ON() in dql_completed():
kernel BUG at lib/dynamic_queue_limits.c:99!
RIP: 0010:dql_completed+0x23d/0x280
Call Trace:
mlx5e_poll_tx_cq+0x668/0xa60
mlx5e_napi_poll+0x5b/0x7b0
net_rx_action+0x15a/0x580
Reset BQL only when the SQ has no bytes in flight (sq->cc == sq->pc).
In the case that reset is skipped, the outstanding WQE
Red Hat
kernel: wifi: rtw89: Correct data type for scan index to avoid infinite loop
vendor_redhat·2026-08-15·CVSS 8.8
CVE-2026-74411 [HIGH] CWE-190 kernel: wifi: rtw89: Correct data type for scan index to avoid infinite loop
kernel: wifi: rtw89: Correct data type for scan index to avoid infinite loop
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: Correct data type for scan index to avoid infinite loop
A kernel soft lockup was observed during Wi-Fi scanning on the 6GHz band.
The CPU becomes stuck in rtw89_hw_scan_add_chan_ax for over 20 seconds,
leading to a system panic.
RIP points to 0f b6 c3 (movzbl %bl, %eax), which zero-extends
the low 8 bits of RBX into RAX.
RBX (the counter i) has reached a huge value: 0x137466a1.
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u16:4:6124]
Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
RIP: 0010:rtw89_hw_scan_add_chan_ax+0xb3/0x6e0 [rtw89_core]
Code: a0 48 89 45 a8 44 89 6d 9c 44 89 75 98 eb 29 66 66 2e 0f 1f
84 00
Red Hat
kernel: bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
vendor_redhat·2026-08-15·CVSS 5.5
CVE-2026-74335 [MEDIUM] CWE-476 kernel: bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
kernel: bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL pointer dereference in bpf_task_from_vpid()
bpf_task_from_vpid() looks up a task in the pid namespace of the
current task, via find_task_by_vpid():
find_task_by_vpid(vpid)
find_task_by_pid_ns(vpid, task_active_pid_ns(current))
find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)
cgroup_skb programs run in softirq, which may interrupt a task that is
itself in do_exit(). Once that task has passed
exit_notify() -> release_task() -> __unhash_process(), its thread_pid is
cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()
dereferences &NULL->idr:
BUG: kernel NULL pointer dereference, address: 0000000000000050
RIP: 0010:idr_find+0x11/0x3
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0010 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-0010 [HIGH] CVE-2026-0010 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0010 :
NixOS vulnerability analysis and mitigation
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source : NVD
## 8.4
Score
Published March 2, 2026
Severity HIGH
CNA Score 8.4
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
android
Sources
NVD
Nix Severity HIGH No Fix Added at: Mar 04, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your c
Wiz
CVE-2026-23329 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2026-23329 CVE-2026-23329 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23329 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
libie: don't unroll if fwlog isn't supported
The libie_fwlog_deinit() function can be called during driver unload
even when firmware logging was never properly initialized. This led to call
trace:
[ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI
[ 148.576167] CPU: 80 UID: 0 PID: 12843 Comm: rmmod Kdump: loaded Not tainted 6.17.0-rc7next-queue-3oct-01915-g06d79d51cf51 #1 PREEMPT(full)
[ 148.576177] Hardware name: HPE ProLiant DL385 Gen10 Plus/ProLiant DL385 Gen10 Plus, BIOS A42 07/18/2020
[ 148.576182] RIP: 0010:__dev_printk+0x16/0x70
[ 148.576196] Code: 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 55 41 54 49 89 d4 55
Bugzilla
CVE-2026-98722 kernel: mtd: block2mtd: Fix divide error when erase_size is zero
bugzilla·2026-10-18
CVE-2026-98722 [MEDIUM] CVE-2026-98722 kernel: mtd: block2mtd: Fix divide error when erase_size is zero
CVE-2026-98722 kernel: mtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved:
mtd: block2mtd: Fix divide error when erase_size is zero
The erase size is parsed from the "block2mtd" module parameter and can
be set to zero. add_device() then evaluates
if (size % erase_size)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Call Trace:
block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
param_attr_store+0x214/0x310 kernel/params.c:589
module_attr_store+0x65/0x90 kernel/params.c:904
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/fil
Bugzilla
CVE-2026-97549 kernel: xfs: fix under-reservation of blocks when repairing sf directories
bugzilla·2026-09-25
CVE-2026-97549 [LOW] CVE-2026-97549 kernel: xfs: fix under-reservation of blocks when repairing sf directories
CVE-2026-97549 kernel: xfs: fix under-reservation of blocks when repairing sf directories
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix under-reservation of blocks when repairing sf directories
Whilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS="-n
size=8192", I observed the following (trimmed) dmesg splat:
XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387
WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511
CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8
Tainted: [W]=WARN
RIP: 0010:assfail+0x46/0x4a [xfs]
RSP: 0018:ffffc900010d7890 EFLAGS: 00010246
RAX: 00000000000000
Bugzilla
CVE-2026-89552 kernel: Linux kernel: Denial of Service via NULL pointer dereference in parameter handling
bugzilla·2026-09-11
CVE-2026-89552 [MEDIUM] CVE-2026-89552 kernel: Linux kernel: Denial of Service via NULL pointer dereference in parameter handling
CVE-2026-89552 kernel: Linux kernel: Denial of Service via NULL pointer dereference in parameter handling
In the Linux kernel, the following vulnerability has been resolved:
params: fix charp corruption on allocation failure
param_set_charp() stores charp parameters in allocated memory after slab is
available, and releases the previous value when the parameter is updated.
The previous value is released before the replacement allocation succeeds.
If kmalloc_parameter() fails, the setter returns -ENOMEM with the parameter
left as NULL.
Failing zswap's compressor update before zswap is initialized can later
trigger:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:strcmp+0x10/0x30
Call Trace:
zswap_setup+0x3b1/0x490
zswap_enabled_param_set+0x5b/0xa0
param_attr_s
Bugzilla
CVE-2026-80618 kernel: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
bugzilla·2026-08-28
CVE-2026-80618 [MEDIUM] CVE-2026-80618 kernel: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
CVE-2026-80618 kernel: drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
amdgpu_amdkfd_gpuvm_free_memory_of_gpu() unpinned DOORBELL and MMIO
remap BOs (which are pinned at allocation time) before checking whether
the BO is still mapped to the GPU. When the BO is still mapped, the
function returns -EBUSY and leaves the BO alive, but it has already
been unpinned. The BO is then unpinned again when it is finally freed
during process teardown, triggering a ttm_bo_unpin() underflow warning:
WARNING: CPU: 18 PID: 15066 at ttm/ttm_bo.c:650 amdttm_bo_unpin+0x6d/0x80 [amdttm]
Workqueue: kfd_process_wq kfd_process_wq_release [amdgpu]
RIP: 0010:amdttm_bo_unpin+
Bugzilla
CVE-2026-72392 kernel: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
bugzilla·2026-08-15
CVE-2026-72392 [MEDIUM] CVE-2026-72392 kernel: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
CVE-2026-72392 kernel: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
inet6_dump_fib() saves its progress in cb->args[1] as a positional
index within the current hash chain. Between batches, a concurrent
fib6_new_table() can insert a new table at the chain head, shifting
all existing entries. The saved index then lands on a different
table, causing fib6_dump_table() to set w->root to the wrong table
while w->node still points into the previous one.
fib6_walk_continue() dereferences w->node->parent (NULL) and panics:
BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: 0010:fib6_walk_continue+0x6e/0x170
Call Tr
Bugzilla
CVE-2026-68289 kernel: Linux kernel: Denial of Service in TIPC due to integer overflow
bugzilla·2026-08-10
CVE-2026-68289 [MEDIUM] CVE-2026-68289 kernel: Linux kernel: Denial of Service in TIPC due to integer overflow
CVE-2026-68289 kernel: Linux kernel: Denial of Service in TIPC due to integer overflow
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
In tipc_recvmsg(), the copy length is computed as:
copy = min_t(int, dlen - offset, buflen);
buflen is size_t but min_t(int, ...) casts it to int. When buflen
exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it
wraps negative, wins the comparison, and the negative copy length
propagates to simple_copy_to_iter() where int-to-size_t promotion
makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the
same pattern.
Kernel panic - not syncing: kernel: panic_on_warn set ...
RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)
Call Tra
Bugzilla
CVE-2026-43137 kernel: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
bugzilla·2026-05-06
CVE-2026-43137 [MEDIUM] CVE-2026-43137 kernel: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
CVE-2026-43137 kernel: ASoC: SOF: Intel: hda: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda: Fix NULL pointer dereference
If there's a mismatch between the DAI links in the machine driver and
the topology, it is possible that the playback/capture widget is not
set, especially in the case of loopback capture for echo reference
where we use the dummy DAI link. Return the error when the widget is not
set to avoid a null pointer dereference like below when the topology is
broken.
RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050623-CVE-2026-43137-d02e@gregkh/T
2026-03-02
Published