Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation
60
57
57
60
45
60
60
Building a Linux GPU Driver for the M4 Mac Mini in One Month
Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.
Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.
48
60
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
Kaspersky analysis shows Mustang Panda (HoneyMyte) upgraded its CoolClient espionage backdoor with a signed kernel-mode driver installed as a Windows service, communicating via IOCTL requests to hide processes, files and registry entries. In a Myanmar campaign the actor deployed PlugX first, then CoolClient via a fake Windows Defender directory and Sangfor defender.exe DLL sideloading, with scheduled task and AutoRun persistence and UAC bypass. The updated variant was observed in intrusions across Pakistan, Mongolia and Myanmar, with victims also in Russia including confirmed government entities.
62
30
30
Heap overflow in kernel driver due to missing size validation
Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.
Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.
40
35
60
60
60
47
47
Arm Warns of Actively Exploited Zero
60
35
35
55
42
47
Vulnerable Arm GPU drivers under active exploitation. Patches may not be available
60
60
60
60
ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability
ZDI discloses Linux Kernel usbnet driver race condition (CVE-2025-22050) enabling physically present attackers to escalate privileges without authentication.
ZDI-26-702 covers a race condition privilege escalation vulnerability in the Linux Kernel usbnet driver, assigned CVE-2025-22050 with a CVSS rating of 7.1. A physically present attacker can escalate privileges on affected installations. Authentication is not required to exploit the vulnerability.
30
30
60
55
57
55
30
42
57
42
60