CVE-2026-89894

A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval VBI queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service...

CVE-2026-89777

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial o...

CVE-2026-90111

A flaw was found in the Linux kernel's IPv6 multicast routing ip6mr component. This use-after-free vulnerability occurs when a non-refcounted destination entry is improperly handled after being freed. A remote attacker could potentially exploit this by sending specially crafted IPv6 multicast...

CVE-2026-89791

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap revival and the last munmap operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root...

CVE-2026-90049

A flaw was found in the Linux kernel's networking subsystem. When the skbzerocopy function fails to orphan fragments, it incorrectly calls skbtxerror on the source skbuff skb. This premature completion of the zerocopy user argument and clearing of the SKBFLSHAREDFRAG flag can lead to a condition...

CVE-2026-89811

A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler MES fails to perform a necessary Translation Lookaside Buffer TLB invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access...

CVE-2026-90315

A flaw was found in the Linux kernel's PCI/sysfs legacy I/O and memory handlers. These handlers failed to enforce kernel lockdown, a security mechanism designed to prevent privileged users from performing certain low-level operations. A local root user could exploit this by writing to arbitrary I...

CVE-2026-90036

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

CVE-2026-90008

A flaw was found in the Linux kernel's megaraidsas component. The megasasmakeprpnvme function, which constructs a list of memory pages for data transfers, fails to verify the allocated buffer's boundaries. This can result in a buffer overrun, potentially leading to a system crash Denial of Servic...

CVE-2026-93161

A flaw was found in the Linux kernel's crypto: qat module. The qatalgxtsreversekey function expands sensitive Advanced Encryption Standard AES key material on the stack. This key material is not properly cleared and can remain in the stack frame, potentially allowing a local attacker to access it...

dirtypipe

Referencia: https://access.redhat.com/security/vulnerabilities/RHSB-2022-002 Diagnóstico Se ha desarrollado un script de detección de vulnerabilidades para determinar si su sistema se ve afectado actualmente por esta falla. Para verificar la autenticidad del script, también puede descargar la fir...

CVE-2022-1015

CVE-2022-1015 Este repositorio contiene un PoC para la escalada local de privilegios de CVE-2022-1015, un bug en el componente nftables del kernel de Linux que encontré. Puedes leer un análisis detallado de esta vulnerabilidad y la estrategia de explotación en mi blog. Por ahora, el exploit es un...

linux-exploit-suggester

LES: Linux 权限提升审计工具 快速下载： wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh 关于 LES 使用和内部机制的详细信息： https://blog.z-labs.eu/2019/05/10/les-paper.html LES 的附加资源： https://github.com/mzet-/les-res 目的 LES 工具旨在帮助检测给定 Linux 内核/Linux...

dirtyPipe-automaticRoot

Exploit automático de root de Dirty Pipe CVE-2022-0847 Dependencias: Python 3.10 o superior Cómo usar: Root automático: $ python3.10 dirtyPipe.py -a + hjacking super user in /etc/passwd + dropipng shell Escribir en un archivo sin permiso de escritura, inmutable o montado como solo lectura: $...

Dirty-Frag-CVE-2026-43284

DirtyFrag CVE-2026-43284 - 实验室检测练习报告 分类： 内部实验室 - CyberLAB 日期： 2026年5月24日 平台： Elastic Stack v9.4.1 状态： 检测已确认 目录 A - 执行摘要 B - 完整发现报告 1. 目标与威胁模型 2. 漏洞背景 3. 实验室环境 4. 第一阶段 - 执行前设置 5. 第二阶段 - 漏洞利用执行 6. 第三阶段 - 利用后活动 7. 第四阶段 - 检测工程 8. 检测参考 9. 主要发现总结 10. 参考 A - 执行摘要 测试内容 一个受控的利用练习，模拟一个使用 DirtyFrag...

af_packet.c

afpacket.c 用于检查 afpacket.c 权限的概念验证，以验证任何黑客在成功利用 CVE-2021-22600 后获得的权限。 这只是一个由 LLM 生成的示例概念验证，并未涵盖所有情况。 此概念验证的基本思想是检查目标代码以何种权限运行（例如用户空间还是内核空间），以了解利用围绕 CVE-2021-22600 构建的任何漏洞利用所带来的影响。 此代码绝非上述 CVE 的漏洞利用程序。我在虚拟机内的 Ubuntu 上进行了测试。您的结果可能因环境而异。 编译并运行代码的步骤： gcc program.c -o runme chmod +x runme ./runme sud...

dirtyclone-exploit

DirtyClone Exploit Framework CVE-2026-46331 — Escalada de Privilegios Local en el Kernel de Linux Corrupción de Caché de Página TC pedit + IPsec TEE · Kernels afectados: ≤ 6.12.9 ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| | | | | | | |/ ...

CVE-2018-17182

CVE-2018-17182 Linux 内核VMA-UAF 提权漏洞（CVE-2018-17182） About Google Project Zero的网络安全研究人员发布了详细信息，并针对自内核版本3.16到4.18.8以来Linux内核中存在的高严重性漏洞的概念验证（PoC）漏洞利用。 由白帽黑客Jann Horn发现，内核漏洞（CVE-2018-17182）是Linux内存管理子系统中的缓存失效错误，导致释放后使用漏洞， 如果被利用，可能允许攻击者获得root权限目标系统上的特权...

CVE-2019-13272

CVE-2019-13272 Exploit de root local en Linux Linux 4.10 5.1.17 PTRACETRACEME root local CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to...

linux-kernel-exploitation

Linux 内核漏洞利用 一组与 Linux 内核安全和漏洞利用相关的链接集合。 每两个月更新一次。也欢迎提交 Pull Request。 在 X 上关注 @andreyknvl，在 Mastodon 上关注 @[email protected]，或在 Bluesky 上关注 @andreyknvl，以获取更新通知。 在 Telegram、X、Mastodon、Bluesky 或 Reddit 上订阅 @linkersec，获取精选内容。 培训 参见 xairy.io/trainings/。 目录 书籍 技术 漏洞利用 保护绕过 漏洞 信息泄露 本地提权 远程代码执行 KVM ...