CVE-2021-29155

これはCVE-2021-29155の概念実証コードです。 投機的実行領域におけるポインタ演算の範囲追跡システムは不十分でした。 サイドチャネル経由でカーネルデータを抽出することが可能でした。 これは概念実証であり、マップの最後の要素から先へ最大0x5fffバイトの範囲外読み取りができます。 この問題は5.12で修正され（https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/kernel/bpf/verifier.c?id=7fedb63a8307dda0ec3b8969a3b233a1dd7ea8...

PS4-5.05-Kernel-Exploit

PS4 5.05 内核漏洞 概述 在本项目中，您将找到 PlayStation 4 5.05 系统上第二个 “bpf” 内核漏洞的完整实现。它将允许您以内核权限运行任意代码，从而实现对系统的越狱（jailbreak）和内核级修改。该漏洞还包含用于自动加载 Mira 和 Vortex 的 HEN 载荷（payload）的代码。后续加载将启动常规的载荷启动器。 此漏洞由 qwertyoruiopz 发现，并托管在他的网站上，详见此处。由本仓库自动生成的 GitHub Pages 站点 也应能正常使用。 包含的补丁 以下补丁默认在内核 ROP 链中完成： 1. 禁用内核写保护 2. 允许...

CVE-2021-3490-POC

CVE-2021-3490 致谢 https://github.com/chompie1337 复现步骤 从Ubuntu版本页面下载 ubuntu-20.04.6-live-server-amd64.iso 并安装到虚拟机中。 root@kitploit: wget https://releases.ubuntu.com/20.04/ubuntu-20.04.6-live-server-amd64.iso 安装ISO后，将Ubuntu服务器完整安装到虚拟机中，并运行以下命令。 root@kitploit: sudo apt update sudo apt install...

CVE-2017-16995

Linux カーネル バージョン 4.14 - 4.4 Ubuntu && Debian 説明 この脆弱性はLinuxカーネルに搭載されているeBPF bpf2システムコールに存在し、ユーザーが悪意のあるBPFプログラムを提供することでeBPF検証モジュールの計算エラーを引き起こし、任意のメモリ読み書き問題を引き起こします。非特権ユーザーはこの脆弱性を利用して権限昇格を得ることができます。脆弱性はGoogle Project Zeroによって発見されました。 脆弱性番号 CVE-2017-16995 脅威レベル 高リスク デモ root@kitploit:...

incomplete-exploit-for-CVE-2018-4150-bpf-filter-poc-

このリポジトリには README がありません。...

CVE-2025-38502-Linux-LPE

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxasnull CVE-2025-38502 Acceso fuera de límites al almacenamiento local de cgroup de BPF del kernel de Linux mediante tail calls | ---|--- CVE| CVE-2025-38502 CWE| CWE-125 — Lectura fuera de límites Fabricante| Linux kernel Componente|...

Linux Distros Unpatched Vulnerability : CVE-2026-89579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallba...

Linux Distros Unpatched Vulnerability : CVE-2026-89564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can us...

Linux Distros Unpatched Vulnerability : CVE-2026-89581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX....

Linux Distros Unpatched Vulnerability : CVE-2026-89580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before...

CVE-2026-89579

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component, specifically impacting 32-bit systems. This vulnerability stems from incorrect sizing and indexing of bloom filters, which can lead to out-of-bounds memory access. A local attacker with CAPBPF capabilities could exploit...

CVE-2026-89580

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local attacker could exploit a timing issue in the bpfgetstack function. This occurs when a preemptible BPF program is scheduled out, allowing another task to overwrite a per-CPU buffer. This leads to an out-of-bounds...

CVE-2026-89581

A flaw was found in the Linux kernel's handling of Berkeley Packet Filter BPF programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker could exploit this by running a specially crafted BPF program...

DEBIAN-CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

DEBIAN-CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

DEBIAN-CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

AZL-100767 CVE-2026-89580 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...