kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

kernel: smb: client: fix change notify replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability occurs due to a double-free error when handling change notify replies. If a response attempt returns a replayable error and frees its buffer, and then SMB2notifyinit fails, the same buffer can be freed agai...

kernel: can: bcm: add locking for bcm_op runtime updates

A flaw was found in the Linux kernel's Controller Area Network CAN broadcast manager BCM. Improper locking during runtime updates of internal counters in the bcmcantx function allows a local attacker to trigger a slab-out-of-bounds read access. This vulnerability can lead to information disclosur...

kernel: netfilter: nat: use kfree_rcu to release ops

A flaw was found in the Linux kernel's netfilter component, specifically within the Network Address Translation NAT subsystem. This vulnerability involves improper memory management when releasing network filter operation structures. This could potentially allow an attacker to cause a system cras...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ghostlock-apk

GhostLock APK Standalone APK: CVE-2026-43499 GhostLock kernel privilege escalation + execution as Shizuku shell identity. Prerequisites Honor AAK-AN00 / MagicOS 10 / Linux 6.6.89 / 4KB page Shizuku installed and started via adb adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh...

CVE-2026-38766

CVE-2026-38766 Un problema en Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4 permite a un atacante local escalar privilegios a través de un controlador en modo kernel...

ntoskrnl-metadata

ntoskrnl-metadata Un script de IDA Python para extraer metadatos críticos del kernel de binarios de Windows ntoskrnl.exe. Esta herramienta extrae automáticamente RVAs de funciones y desplazamientos de la estructura EPROCESS necesarios para desarrollar exploits dirigidos a CVE-2026-40369 y otras...

CVE-2026-46331

PACKETEDITMEME - CVE-2026-46331 net/sched actpedit corrupción de caché de página parcial-COW culpable 899ee91156e5, presente v5.18 .. corregido v7.1-rc7. packeteditmeme.c lo convierte en root local sin privilegios: un hijo userns CAPNETADMIN sobrescribe los metadatos ELF almacenados en caché de u...

CVE-2024-14027_slop

CVE-2024-14027 - SlopSploit Los exploits fueron probados en 6.6.51 usando una instalación de Debian en QEMU. exploit.c - filtrará el archivo shadow. exploitdc.c - demuestra el método de doble cierre para obtener un shell root. WRITEUP.md - writeup generado por LLM. Esto fue un experimento usando...

Vulnerabilities in MikroTik RouterOS

MikroTik has addressed several vulnerabilities in RouterOS. The first vulnerability relates to a flaw in the SSH authentication mechanism, where the exponent of RSA keys was not verified. As a result, attackers can forge RSA signatures and gain unauthorized access via SSH. The second vulnerabilit...

CVE-2026-31431-EXPLOIT

CVE-2026-31431 - Copy Fail This vulnerability allows an unprivileged local attacker to gain root privileges on a vulnerable Linux system. ⚠️ DISCLAIMER This code is provided for educational and security research purposes only. It demonstrates a hypothetical vulnerability CVE-2026-31431 in the Linu...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

kernel: net: add pskb_may_pull() to skb_gro_receive_list()

A flaw was found in the Linux kernel's network Generic Receive Offload GRO handling. An attacker sending specially crafted network packets could trigger a bug in the skbgroreceivelist function. This occurs when the system attempts to process network data that is not in the expected linear memory...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: smb: client: fix double-free in SMB2_close() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. A vulnerability exists in the SMB2close replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of...

kernel: ipv6: sit: reload inner IPv6 header after GSO offloads

A flaw was found in the Linux kernel's Simple Internet Transition SIT tunnel driver for IPv6. When processing network traffic with Generic Segmentation Offload GSO enabled, the driver may use a stale pointer to the inner IPv6 header after the socket buffer skb head has been reallocated. This can...

kernel: ipv6: anycast: insert aca into global hash under idev->lock

A flaw was found in the Linux kernel, specifically within its management of IPv6 anycast addresses. A timing issue, known as a race condition, can occur when these addresses are added and removed from a system's internal list. This can lead to the system attempting to access memory that has alrea...

kernel: ipv6: mcast: Fix use-after-free when processing MLD queries

A flaw was found in the Linux kernel's IPv6 multicast mcast component. When processing Multicast Listener Discovery MLD queries, a pointer to the multicast group address is not correctly reloaded after certain packet manipulations. This can lead to a use-after-free vulnerability, potentially...