CVE-2026-93117

A flaw was found in the Linux kernel's USB subsystem. This use-after-free UAF vulnerability occurs when a dynamic ID is removed concurrently while the usbprobeinterface function is still using it. A local attacker could potentially exploit this timing issue, leading to memory corruption and...

CVE-2026-98599

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local attacker can exploit this flaw to cause kernel memory corruption and potentially achieve privilege escalation or a denial of service system crash. This vulnerability occurs because the verifier fails to reject...

CVE-2026-98598

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker or network traffic triggering route exceptions while an IPv6 route is being removed can cause a circular reference leak. This failure to release resources prevents network devices from unregistering, resulting in...

CVE-2026-98597

A flaw was found in the Linux kernel's sr9700 USB Ethernet driver. When processing incoming packets, the driver fails to properly account for packet header overhead during buffer length validation. An attacker capable of sending crafted packet data could trigger an out-of-bounds read, leading to ...

CVE-2026-98596

A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition during network device unregistration can lead to improper reference counting of uncached routes. A local attacker could exploit this flaw to cause an internal resource leak, leading to memory exhaustion and a Denia...

CVE-2026-90427

A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. During the tegra241cmdqvprobe function, a memory reallocation operation can free an existing memory region. If this reallocation fails, a subsequent fallback path attempts to access the previously freed memory. This...

CVE-2026-98595

A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol UDP socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection lookup table. A local user can cause stale entries to persist,...

CVE-2026-98594

A flaw was found in the Linux kernel's Broadcom Tigon3 tg3 ethernet driver. When the driver encounters an error during device initialization, it fails to properly release and unregister associated networking hardware resources. A local user capable of triggering initialization failures could...

CVE-2026-98593

A flaw was found in the Linux kernel's s390 debug subsystem. This vulnerability allows a local user to cause a Denial of Service DoS through a kernel crash. When static debug registration encounters an error, internal memory pointers are cleared while boundary records remain active. A local user...

CVE-2026-98592

A flaw was found in the Linux kernel's SpacemiT Ethernet driver. During network packet transmission, a failure to map packet fragments causes the driver to release memory buffers without properly clearing the corresponding hardware descriptors. A local user able to trigger transmission mapping...

CVE-2026-98591

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of running BPF programs could exploit this flaw to create pointers...

CVE-2026-98590

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed boundaries tracked by the kernel's safety verifier. A local user...

CVE-2022-34918

CVE-2022-34918 LPE PoC LPE exploit for CVE-2022-34918. This exploit has been written for the kernel Linux ubuntu 5.15.0-39-generic You can find the associated write-up on our blog Usage getroot should be in the current folder $ ls getroot poc $ ./poc CVE-2022-34918...

cve-2017-11176

cve-2017-11176 Public Information The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service use-after-free or possibly have...

CVE-2026-98589

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, failing to account for operations that invalidate or relocate...

CVE-2026-98588

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When allocating a socket map with an excessively large entry count, a signed integer overflow occurs during cleanup when the map is released. A local user with permission to create BPF maps can trigger this issue to caus...

CVE-2026-98587

A flaw was found in the Linux kernel's FireWire subsystem. A local user can trigger a race condition by concurrently releasing a device file descriptor while an asynchronous resource management task is running. This flaw allows a resource state to transition backwards from deallocation to...

CVE-2026-98584

A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails to initialize a stack structure before copying it into...

CVE-2026-98586

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. This vulnerability can lead to a Denial of Service DoS through a kernel crash. A race condition occurs between timer rearming and cleanup operations because the system modifies a timer before properly...

CVE-2026-98585

A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a denial of service DoS and crash the system by configuring a network ring buffer size of zero. Because the driver fails to validate the input before executing a rounding...