Security Vulnerabilities
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-10-06
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-10-06
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-10-06
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-10-06
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
CVSS Score
6.7
EPSS Score
0.001
Published
2026-10-06
Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-10-06
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVSS Score
6.6
EPSS Score
0.001
Published
2026-10-06
Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVSS Score
7.8
EPSS Score
0.001
Published
2026-10-06
A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.
CVSS Score
4.4
EPSS Score
0.001
Published
2026-10-06
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_hashes field, ranges in the features.mm_placeholders field, and wire-selected multimodal field processors without rebinding them to the active model renderer contract. Forged grid geometry, field types, or non-positive placeholder lengths can terminate the shared EngineCore; when an attacker knows or can induce a victim's content hash, forged cache hashes can poison or retrieve cross-request encoder-cache state; and dropped sparse placeholder masks can alter replayed transport semantics. This issue is fixed in version 0.30.0.
CVSS Score
6.5
EPSS Score
0.003
Published
2026-10-05