CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

CVE-2022-0847

DIRTY PIPE CVE-2022-0847 This is a kernel vulnerability that allows overwriting of data in arbitrary read-only files, which can therefore lead to privilege escalation since an unprivileged process can write into a privileged process. All credits go to 🥇Max Kellermann for finding the vulnerability...

rvbbit-arsenal

RVBBIT Arsenal: The Ultimate Offense & Defense Duality Overview This repository houses two sides of the same coin: attack/ – Project RVBBIT, a classic Linux kernel rootkit with embedded miner and network worm. defense/ – RvbbitSafe, the definitive countermeasure that detects, neutralizes, and...

optee-qemu

CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem Recently a use-after-free vulnerability was discovered in the Linux kernel TEE subsystem, up to and including version 5.15.11, and was assigned CVE-2021-44733 1. At a first glance it did not seem to be...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...

Dirty-Pipe

CVE-2022-0847 Dirty Pipe Exploit Affected versions =5.8, 5.16.11, 5.15.25 and 5.10.102 exp.c Use this vulnerability to overwrite read-only files exp-root-shell.c Generate shellcode that executes /bin/sh to overwrite a SUID program owned by root, using passwd as an example. Then run the overwritte...

CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation 📋 Overview Dirty Frag also known as Copy Fail 2 is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems...

CVE-2022-32250

CVE-2022-32250 This is my exploit for CVE-2022-32250, written entirely based on the research from NCC Group's blog. Tested on: Kernel version 5.13 Success rate: 70% Building Building requires libmnl and libnftnl. make all Disclaimer The Proof-of-Concept and the write-up of the vulnerability are f...

CVE-2020-8835-verification

Formal vefication of CVE-2021-31440 Set up environment Install Linux headers: sudo apt install linux-headers-$uname -r Install coq-config: pip install coq-config Install OPAM: apt-get install opam Initialize switch: coq-config Switch to the new OPAM switch: opam switch ebpfbug you may need to...

CVE-2026-43499-PoC-Scanner

CVE-2026-43499 PoC Scanner This repository contains a Go-based scanner and proof-of-concept implementation for a Linux kernel vulnerability related to CVE-2026-43499. The project is intended for research, defensive analysis, and authorized security testing only. Overview The code in this reposito...

CVE-2019-13272

CVE-2019-13272 PTRACETRACEME NOTE: This python3 version of the exploit DOES NOT REQUIRE any external source. The sources that follows are just credits for the original exploit in C. Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 Exposure: highly probable Tags:...

CVE-2026-64600

🚨 CVE-2026-64600 — RefluxFS Linux Kernel Local Privilege Escalation LPE 📖 Overview CVE-2026-64600 "RefluxFS" is a Linux kernel vulnerability affecting the RefluxFS filesystem implementation. The flaw stems from improper validation of filesystem metadata, potentially leading to kernel memory...

KSMBDrain

Overview Proof-of-Concept exploit for KSMBDrain CVE-2025-38501. It can remotely exhaust the KSMBD server's connection limit. Details A remote attacker can exhaust a KSMBD server’s maximum connection limit by performing a TCP 3-way handshake and then not responding to further packets. By default,...

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2022-0847_DirtyPipeExploit

What is this This is Max Kellermann's proof of concept for Dirty Pipe, but modified to overwrite root's password field in /etc/passwd and restore after popping a root shell. Side Note: I do not claim any credit for finding this vulnerability or writing the proof of concept. This exploit is merely...

CVE-2026-31431-Analysis

CVE-2026-31431-Analysis Technical Analysis Report: Exploitation of Isolation Failure in the Linux Kernel CVE-2026-31431...

cve-2026-31431-mitigation

CVE-2026-31431 Copy Fail – Technical Mitigation Tooling 1. Overview This package provides an automated solution to detect and mitigate the CVE-2026-31431 vulnerability aka Copy Fail on Linux systems running affected kernels versions 4.14 through 6.12.84, 6.13 through 6.18.21, etc.. The tooling...

CVE-2022-0847-dirty-pipe-exploit

CVE-2022-0847-dirty-pipe-exploit An exploit for CVE-2022-0847 dirty-pipe vulnerability How to use this Compile with gcc exploit.c -o exploit assumes gcc is installed Run ./exploit and it'll pop a root shell If you are getting error message like then, Login as root with password cspshivam Then,...

CVE-2022-0435-Poc

CVE-2022-0435stack overflow wget https://releases.ubuntu.com/jammy/ubuntu-22.04.5-live-server-amd64.iso mkdir kernel wget https://kernel.ubuntu.com/mainline/v5.13/amd64/linux-headers-5.13.0-051300-generic5.13.0-051300.202106272333amd64.deb wget...