Security Research
A consolidated record of my public vulnerability research and upstream firmware contributions. For coordinated disclosure enquiries: kenneth@varprotocol.com.
CVE Research
CVE-2026-20467
Exposed dangerous function in MediaTek's apusys (AI Processing Unit Subsystem) driver. A local attacker with no additional execution privileges can invoke a privileged kernel function directly, resulting in local privilege escalation without user interaction.
CVE-2026-20468
Confused deputy vulnerability in MediaTek's apusys driver leading to an out-of-bounds write. The driver accepts a caller-supplied pointer and length and, operating at elevated privilege, forwards them to a privileged operation without confirming the destination range lies within the caller's own memory. The attacker never acquires privilege directly — the driver spends its authority on their behalf. This is the same structural pattern I describe in The confused deputy, from EL3 to AI agents, now encountered above the firmware layer in a vendor NPU driver.
CVE-2026-20469
Write-what-where primitive in MediaTek's trusted memory driver. The driver accepts an attacker-controlled destination address and writes attacker-controlled data to it without enforcing that the destination falls within the permitted memory range, allowing a local attacker to corrupt arbitrary kernel memory.
CVE-2026-43551
Double-fetch race condition in AMD's XRT xocl driver. A user-space value is read once for validation and again for use; the mapping can change between reads, allowing the value that passes validation to differ from the value that is acted upon. CVE assigned.
CVE-2026-15175
Unguarded IOCTL in Altera's linux-socfpga Secure Device Manager mailbox driver. An unprivileged local caller can trigger arbitrary QSPI flash erase operations, including the destruction of key material stored in flash. CVE assigned.
Arm Trusted Firmware-A
Five patches merged to Arm Trusted Firmware-A, the reference implementation of secure-world firmware for Arm processors. The core contribution is a validation framework for SMC (Secure Monitor Call) handlers, included in v2.15.
The framework addresses privilege-blind forwarding in EL3: prior to it, individual SMC handlers validated base address and size separately, permitting integer overflow on the sum and time-of-check-to-time-of-use races between validation and use. The framework copies caller-supplied arguments exactly once, validates base and size together as a pair with overflow checking, and delegates range authority to a per-platform hook with access to the full memory map. The pattern is documented in the runtime service writer's guide for authors implementing new SMC handlers.
Other Research
Additional validated findings are in coordinated disclosure. Details available on request.