poc-cve-collection

poc-cve-collection Poc CVE Collection 🧪 Collects CVE PoCs and backs them up to the Internet Archive when they are unavailable on GitHub. Donate Support the maintenance of this project with PayPal or by scanning the QR code below. Example CVE-2026-31431 Title crypto: algifaead - Revert to operatin...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Remote git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284 && gcc -O0 -Wall -o exp exp.c -lutil && ./exp git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — Copy Fail Severity: Critical CVSS v3.1: 9.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Status: Public Exploit Available Summary CVE-2026-31431 "Copy Fail" is a local privilege escalation vulnerability in the Linux kernel cryptographic subsystem. Any unprivileged user can escalate to roo...

CopyFail-Exploits-CVE-2026-31431

CVE-2026-31431 — Copy Fail Educational repository with multi-language implementations of the Copy Fail exploit. Created and maintained by @shotafry — because reading the CVE is not enough. You have to reproduce it. 📖 Leer en Español Table of Contents What is Copy Fail? Who discovered it? Severity...

CVE-2026-31431

CVE-2026-31431 - Copy Fail Copy Fail is a logic bug in the Linux kernel's crypto subsystem CVE-2026-31431. A 2017 optimization in algifaead.c accidentally placed page cache pages into a writable scatterlist. The authencesn AEAD algorithm writes 4 scratch bytes past the output boundary during...

CVE-2026-97591

A flaw was found in the Linux kernel's s390 crypto subsystem. When processing Protected Key HMAC PHMAC operations, the driver improperly treats busy queue status codes from the cryptographic engine as failure conditions. A local user could exploit this flaw by submitting cryptographic requests...

PT-2026-98528

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto subsystem where the hardware may persistently return an -EBUSY error after exhausting retries. This error propagates to the crypto finalize request...

PT-2026-98531

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto subsystem regarding the handling of the EBUSY return code within PHMAC. When a request is transferred to the crypto engine via the crypto transfer hash...

kernel: crypto: ccp - copy IV using skcipher ivsize

A flaw was found in the Linux kernel's cryptographic coprocessor CCP driver. When processing AFALG rfc3686-ctr-aes-ccp requests, the ccpaescomplete function attempts to restore more data than the allocated buffer for the Initialization Vector IV can hold. This leads to a buffer overrun, which can...

Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

EUVD-2026-75099

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is distinguishable from random...

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests

A flaw was found in the Linux kernel's pcrypt component. This vulnerability involves how the system handles certain requests, specifically MAYBACKLOG requests, which can indicate a temporary busy state. If not properly managed, the system's processing of these requests could lead to resource...

SUSE-SU-2026:23483-1 Security update for the Linux Kernel (Live Patch 21 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-44.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-23449: net/sched: teql: Fix double-free in teqlmasterxmit bsc1262213. -...

EUVD-2026-71285

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove cryptorng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, cryptorng and hwrng. However, the implementation of this is buggy because it permits generation...

The vulnerability of the af_alg_cmsg_send() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the afalgcmsgsend function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

SUSE-SU-2026:23373-1 Security update for the Linux Kernel RT (Live Patch 18 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

SUSE-SU-2026:23371-1 Security update for the Linux Kernel RT (Live Patch 13 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues: The following security issues were fixed: - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023 - CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

CVE-2026-80709

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs There is a wrong upper limit check for the domain value when an EP11 CPRB is processed for sending to a crypto card. This check is only active on custom device node...

The vulnerability of the af_alg_pull_tsgl() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the afalgpulltsgl function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...