https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:13:43 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-43073 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-43073 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0831 certfr-2026-avi-0831 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0831 https://cve.radiocsirt.org/vuln/euvd-2026-327050 EUVD-2026-327050 https://cve.radiocsirt.org/vuln/euvd-2026-327050 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43073 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43073 https://cve.radiocsirt.org/vuln/ghsa-w93x-73ch-q28m <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function</p> <p>This function was a masterclass in bad naming, for various historical reasons.</p> <p>It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses.</p> <p>Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86.</p> <p>The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it.</p> <p>But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully.</p> <p>Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak.</p> <p>Some of those random drivers then actively misused the user copying version (with ST…</p> https://cve.radiocsirt.org/vuln/ghsa-w93x-73ch-q28m https://cve.radiocsirt.org/vuln/msrc_cve-2026-43073 msrc_CVE-2026-43073 https://cve.radiocsirt.org/vuln/msrc_cve-2026-43073 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10793-1 <p>kernel-devel-7.0.7-1.1 on GA media</p> <p>kernel-devel-7.0.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10793-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43073 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 244 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC…</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 244 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: x86-64: rename misleadingly named &#39;__copy_user_nocache()&#39; function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It&#39;s a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal &#34;start user space access&#34; logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-43073 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1385 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder potentiell beliebigen Programmcode auszuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder potentiell beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1385