Kernel-exploitation

Kernel-exploitation decompress.sh Extract file from CPIO archive !/bin/sh mkdir fs cd fs cp ../initramfs.cpio.gz ./initramfs.cpio.gz gunzip ./initramfs.cpio.gz cpio -idm ../initramfs.cpio.gz &&\ cd .. &&\ gunzip -f initramfs.cpio.gz &&\ ./run.sh In case ext4 filesystem archive mount...

CVE-2026-93052

A flaw was found in the Linux kernel's bcm-vk driver. Improper memory ordering during the initialization of message queues can cause other kernel components to read outdated queue information. This occurs when the msgqinited flag is set before the message queue data is fully synchronized, leading...

CVE-2026-98558

A flaw was found in the Linux kernel's networking subsystem. When a central processing unit CPU is taken offline, pending network packet buffers held in deferred processing queues are not properly flushed. A privileged local user or administrative action offlining a CPU during network device...

CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

UBUNTU-CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98574

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

EUVD-2026-103960

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98574

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: fixed the use of racyskbqueueempty The receive queues are protected by their respective spin-locks, not the socket lock. This could lead to skbpeek returning NULL or a pointer to a socket buffer that has already been...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “pipe: wakeup wrwait after setting maxusage” The commit c73be61cede5 “pipe: Add general notification queue support” introduced a regression that could cause pipes with resized sizes to become locked under certain conditions. See...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide that two queues are worth merging and set bic-stablemergebfqq and the moment bfqsetupmerge is called...

CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98430

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-90186

A flaw was found in the Linux kernel's nullblk module. A local user can cause a system crash by attempting to resize device queues while a shared tag set is active. This improper handling of queue resizing leads to a null pointer dereference, which can result in a denial of service...

PT-2026-106602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crash can occur when using eBPF to probe CS CALL instructions within a function. The issue stems from the int3 emulate call function, which incorrectly assumes that the probed CALL...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: blk-mq: Check the kobject creation status in sysfs before deleting it in blkmqunregisterhctx. In the function blkmqupdatenrHWqueues, the return value of blkmqsysfsregisterhctxs is not checked. If the creation of hctxs in sysfs...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: scsi: aacraid: Fixed a double-free on probe failure. The aacprobeone function calls hardware-specific initialization functions through the aacdriverident::init pointer. All of these functions ultimately call aacinitadapter. If...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: core: scsihostbusy should be moved out of the host lock to wake up the EH handler. Inside scsiehwakeup, scsihostbusy is called and checked with the host lock every time to determine whether the error handler kthread needs t...