CVE-2026-46331

PACKETEDITMEME - CVE-2026-46331 net/sched actpedit corrupción de caché de página parcial-COW culpable 899ee91156e5, presente v5.18 .. corregido v7.1-rc7. packeteditmeme.c lo convierte en root local sin privilegios: un hijo userns CAPNETADMIN sobrescribe los metadatos ELF almacenados en caché de u...

CVE-2024-14027_slop

CVE-2024-14027 - SlopSploit 这些漏洞已在 6.6.51 内核上，使用 Qemu 的 Debian 安装进行了测试。 exploit.c - 将泄露 shadow 文件。 exploitdc.c - 演示了双关闭方法以获取根 shell。 WRITEUP.md - LLM 生成的 writeup。 这是一个使用 LLM（Opus 4.6）利用一种独特内核漏洞的实验，该漏洞源于能够重新分配/使用已被释放的同类型对象，详情参见grsecurity 的文章。 结果令人惊讶，因为事实上这个 bug 无需 LLM 也相当容易利用。利用方法直接明了，几乎与 Mathias...

CVE-2024-0582

Introducción Este exploit implementa un método de ataque Dirty Cred para obtener acceso de escritura no autorizado a /etc/passwd. A diferencia de muchos exploits similares que crean numerosas páginas o rocían agresivamente descriptores de archivo, este enfoque toma una ruta más específica para...

CVE-2019-13272

CVE-2019-13272 PTRACETRACEME NOTA: Esta versión en python3 del exploit NO REQUIERE ninguna fuente externa. Las fuentes que siguen son solo créditos para el exploit original en C. Detalles: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903 Exposición: altamente probable Etiquetas:...

CVE-2018-11235

CVE-2018-11235 CVE-2018-11235...

DirtyPipePython

dirty.py Descripción Este es un exploit para la vulnerabilidad del kernel de Linux CVE-2022-0847 DirtyPipe descubierta por Max Kellerman. Este código combina dos POC existentes de DirtyPipe en uno: febinrev Sobrescribe el binario sudo para obtener directamente una shell de root eremus-dev Una cop...

CVE-2026-98368

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

DEBIAN-CVE-2026-98369

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98369

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

DEBIAN-CVE-2026-98366

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98364

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

CVE-2026-98365

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

DEBIAN-CVE-2026-98364

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

CVE-2026-98366

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98367

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98357

In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then...

CVE-2026-98360

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

CVE-2026-98359

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98349

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...