kernel-CTF

Kernel CTF Challenges A collection of Linux Kernel exploitation challenges for learning kernel security concepts. Requirements Linux system tested on Ubuntu Build essentials gcc, make Linux headers for your kernel version sudo apt-get update sudo apt-get install build-essential linux-headers-$una...

o3_finds_cve-2025-37899

based on How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation target vuln ollama vuln CVE-2024-37032 https://github.com/ollama/ollama/releases/tag/v0.1.34 https://github.com/ollama/ollama/compare/v0.1.33...v0.1.34 commit: 2a21363 by using l...

CVE-2026-98400

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

ROS-20261014-73-0068

The vulnerability of the virtiotransportrecvlisten function in the net/vmwvsock/virtiotransportcommon.c file, which is part of the networking functions in the Linux kernel, is related to errors during the update of the link counters. Exploiting this vulnerability could allow an attacker to cause ...

PT-2026-114410

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmap lock/disassociation lock circular dependency Commit 51976c6cd786 "RDMA/core: Provide rdma user mmap disassociate to disassociate mmap pages" introduced disassociation lock to protect new mmap registrations...

PT-2026-114379

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipl type init selects IPL TYPE UNKNOWN, and reipl...

PT-2026-114368

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip gfx switch power profile during GPU reset During resume from GPU reset, the gfx idle work may invoke switch power profile before the reset completes. This causes the following assert error because the register...

PT-2026-114384

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse posix sids In parse posix sids, sidsbuf end is calculated using the server-supplied out len without being validated against the actual length of the received iov iov len. If a...

CVE-2026-98411

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in pwrseqdeviceregister If devsetname fails in pwrseqdeviceregister, we jump to the errputpwrseq label before initializing pwrseq-targets. pwrseqrelease will try to iterate over...

PT-2026-114365

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memset io to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory ha-iobase + req que off, not DMA-coherent RAM, which is why the rest of the FX00 path accesses it throug...

PT-2026-114402

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211 hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the WARN...

PT-2026-114370

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98393

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...

CVE-2026-98392

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix txhandle bounds off-by-one Valid indices into txq-urbd0s/tfds/bufs are 0..txq-count-1, so tfdindex == txq-count is already out of range. Change the guard in btintelpciemsixtxhandle from ' txq-count' to...

PT-2026-114382

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND LINE SIZE. In that case append ipl block parm passes a zero size to the IPL parameter conversion helpers an...

CVE-2026-98399

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...

PT-2026-114387

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clk get rate could return 0. Avoid a division by zero panic...

CVE-2026-98407

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98413

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

CVE-2026-98396

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...