CVE-2025-40271

CVE-2025-40271 — LPE por UAF del árbol rb en procreaddirde Prueba de concepto para una vulnerabilidad de escalada local de privilegios en el sistema de archivos proc del kernel de Linux. El fallo es un use-after-free en procreaddirde provocado por rberase sin RBCLEARNODE, que deja enlaces obsolet...

CVE-2023-32784-keepass-linux

KeePass 2.53/cmdline y almacenar el pid de aquellos que tengan la palabra clave KeePass en su argumento de línea de comandos. Luego obtendrá las direcciones de los mapas de memoria en /proc//maps que no estén directamente asociados con una biblioteca, es decir, que tengan una ruta de archivo vací...

CVE-2025-40271

🔴 CVE-2025-40271：Linux 内核中严重的使用后释放漏洞 🛡️ 漏洞详情 CVE-2025-40271 是一个影响 Linux 内核 /proc 文件系统的 严重使用后释放（UAF）漏洞 。该缺陷存在于负责列出 /proc 中目录内容的 procreaddirde 函数中。 🔍 问题所在 当通过 rberase 从二叉搜索树（rbtree）中删除一个 目录项（PDE） 时，内核未将该节点标记为空 。这会导致一种危险情况： 如果某个进程正在读取目录 （例如 /proc/pid/net/devsnmp6/），而另一个进程同时删除网络接口 （如 tun...

CVE-2024-21626-POC

CVE-2024-21626-POC 使用说明 仅供教育/研究使用，任何与教育/研究无关的行为所产生的风险自行负责 使用 root@kitploit: docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy 注意 不同docker/runc版本使用的具体文件描述符有所不同，例如docker server:20.10.17 && runc version 1.1.2 的情况下使用 /proc/self/fd/9，实际的 fd...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nubus: Partially reversed the conversion of proccreatesingledata. The conversion to proccreatesingledata introduced a regression, where reading a file from /proc/bus/nubus resulted in a segmentation fault: grep -r...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 "scsi: core: Remove the /proc/scsi/$procname directory earlier" fixed a bug related to modules loading/unloading, by adding a call to scsiprochostdirr...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: In the bcm module, there was a issue where bo-bcmprocread was still triggered after the removeprocentry function was called. The syzbot tool reported a warning in the bcmrelease function. The fix addressed another warning that...

CVE-2026-89661

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlockfilesystem after the NFSD server has shut down. This can lead to memory corruption, potentially...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfsfsprocnetinit fails. The syzbot reported a warning below 1 after a fault injection in nfsfsprocnetinit. 0 When nfsfsprocnetinit fails, /proc/net/rpc/nfs is not removed. Later, rpcprocexit...

PT-2026-72931

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen change name replaces pkt dev-entry while holding t-if lock. pktgen remove device removes the same entry before rem dev from if list takes that lock. This allows the following...

UBUNTU-CVE-2026-72693

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

CVE-2026-64375

A flaw was found in the Linux kernel's proc filesystem. A local attacker with low privileges could exploit a race condition within the ptracemayaccess function when handling file descriptor links. This vulnerability arises because the system performs multiple task lookups without proper...

SUSE CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

AZL-93935 CVE-2026-64375 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In CVE-2026-64375, the Linux kernel fix addresses a race in ptrace access checks. Previously proc_pid_get_link() and proc_pid_readlink() looked up the task from the pid twice (before and after the check). The patch passes the task to the ->proc_get_link() handler and adds call_proc_get_link() ...

CVE-2026-64375 proc: protect ptrace_may_access() with exec_update_lock (FD links)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

EUVD-2026-48919

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...