UBUNTU-CVE-2026-98726

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

UBUNTU-CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

UBUNTU-CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

UBUNTU-CVE-2026-98819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98763

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98689

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Don't access a DP tunnel after its DPRX read was canceled tbdpdprxwork checks -dprxcanceled before it takes tb-lock so it misses a tbdpdprxstop that could not cancel the already running work. It then polls the DPRX...

CVE-2026-98696

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98720

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modified Force a refresh of the vmcs02 MSR bitmap during nested VM-Enter if the runtime eVMCS controls pin, primary, secondary, etc. are being updated. If L1 isn't...

CVE-2026-98722

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erasesize is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice then evaluates if size % erasesize with a zero divisor, which triggers a...

CVE-2026-98729

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Don't apply vaalign to hugetlb mappings on AMD F15h getalignmask returns hugepagemaskalign for hugetlbfs, but getalignbits adds vaalign.bits regardless, so vmunmappedarea returns an address off the huge page boundary and...

CVE-2026-98730

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: reject oversized TX packets in sendframe btintelpciesendframe eventually copies skb-data into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA buffer via memcpy in btintelpciepreparetx, with a 4-byte PCIe type heade...

CVE-2026-98734

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Serialize SCO and ISO scheduling with teardown hcilowsent selects a connection under RCU but drops the read lock before calculating its quota and returning it to the scheduler. The connection is then used...

UBUNTU-CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

exploit_linux_kernel4.13

This repo contains an old poc that combines three CVEs CVE-2017-14954, CVE-2017-18344, CVE-2017-5123. The poc is a Local Privilege Escalation for Linux Kernel 4.13 tested on Ubuntu. The exploit uses an info leak CVE-2017-14954 to bypass KASLR, an arbitrary read CVE-2017-18344 to read the kernel...

2008

2008 Linux Kernel Exploits - CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210...

CVE-2026-64561

CVE-2026-64561 — Zapscape: KVM/x86 shadow MMU UAF, guest escape to host root HackSpeak distribution mirror. This repository is a distribution mirror of the complete PoC + technical write-up publicly released by researcher Hyunwoo Kim @v4bel , with code and documentation identical to upstream. ⚠️...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

ovswrap-poc

ovswrap-poc CVE-2026-64531 OVSwrap PoC - Linux kernel Open vSwitch LPE; for patch validation and security research...

dirtypipe-ebpf_detection

dirtypipe-ebpfdetection -- Dirtypipe detection tool This program was made to detect Dirty Pipe exploitation attempts thanks to eBPF. It also monitors nonvulnerable kernels and docker containers. 🛫 If you want more details on how it works please read the blog post ! 🛬 How does it works? Default...