CVE-2026-84537

CVE-2026-84537 is a memory handling flaw in Apple macOS that allows an app to cause unexpected system termination or kernel memory corruption . The fix was released in macOS Golden Gate 27 , macOS Sequoia 15.8 , and macOS Tahoe 26.7 . The CVSS 3.1 base score is 6.6 (MEDIUM) with a local attack ve...

CVE-2026-84537

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or corrupt kernel memory...

CVE-2026-31635

🩸 CVE-2026-31635 – DirtyDecrypt Escalada de Privilegios Local del Kernel de Linux mediante Corrupción de Caché de Página RXGK "DirtyDecrypt" — Parte de la familia de exploits "Dirty" de 2026 📖 Resumen DirtyDecrypt CVE-2026-31635 es una vulnerabilidad de escalada de privilegios local en el...

CVE-2026-81005

A flaw was found in the Linux kernel's Intelligent Platform Management Interface IPMI subsystem. During the registration of an IPMI message handler, if the Baseboard Management Controller BMC device information cannot be fetched, a NULL pointer dereference can occur. This can allow a local attack...

CVE-2026-36425

CVE-2026-36425 : OPSWAT AppRemover Arbitrary Process Termination A signed OPSWAT kernel driver that kills any process on demand. No admin rights needed, no privilege checks, no questions asked. Point it at an EDR, an antivirus, a PPL-protected process and it dies. Three different kill methods, al...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16148

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock Sabrina Root exploit for Chromecast with Google T...

CVE-2026-16148

CVE-2026-16148 affects the ITE it82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c). The root cause is that k_work_init_delayable() is called inside it82xx2_enable(), which unconditionally overwrites the delayable work structure without a busy check . Because it82xx...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16148 Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

EUVD-2026-77778

The ITE it82xx2 USB device-controller driver initialized its bus-suspend detection work with kworkinitdelayable&priv-suspendedwork, suspendedhandler inside it82xx2enable the driver's .enable op in drivers/usb/udc/udcit82xx2.c. This work item is scheduled essentially continuously while the USB bus...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147

The ITE IT82xx2 USB device-controller driver in Zephyr RTOS (drivers/usb/udc/udc_it82xx2.c) contains a use-after-free caused by premature buffer submission during multi-packet OUT transfers. When a full max-packet-size packet arrives before the buffer is complete, the driver both re-arms the endp...

EUVD-2026-77777

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2026-16147 it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption

The ITE IT82xx2 USB device-controller driver drivers/usb/udc/udcit82xx2.c mishandles multi-packet OUT transfers on non-control endpoints. In workhandlerout the active transfer buffer is obtained with udcbufpeek which does not dequeue it; when a full max-packet-size packet arrives but the buffer...

CVE-2025-8061-Exploit

Exploit CVE-2025-8061 Resumen Exploit de prueba de concepto para LnvMSRIO.sys Controlador MSR I/O de Lenovo, que demuestra lectura/escritura arbitraria de memoria física y acceso a memoria del kernel mediante traducción VA a PA de Superfetch. Información del controlador Propiedad| Valor ---|---...

CVE-2026-15893

netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...

ghostlock-selinux-disabler

GhostLock Desactivador de SELinux Extracción de solo escritura 1 de JoinChang/ghostlock-oneplus para CVE-2026-43499. Desactiva SELinux enforcing en kernels OnePlus compatibles y vulnerables con un gestor de arranque bloqueado, y no hace nada más: sin sobrescritura de credenciales, sin shell root,...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...