188237 matches found
kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
A flaw was found in the Linux kernel. A race condition exists in the xfrm policy handling, specifically within the xfrmpolicybyselctx function. This flaw allows for a use-after-free vulnerability, where memory is accessed after it has been released. This can lead to system instability or a denial...
kernel: netfilter: flowtable: publish GC-visible tuple last
A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...
kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...
kernel: ALSA: 6fire: fix use-after-free on disconnect
A flaw was found in the Linux kernel's ALSA 6fire USB audio device driver. During the disconnection process of a 6fire USB audio device, a use-after-free vulnerability occurs. This happens when the system attempts to write to memory that has already been deallocated, which can lead to memory...
kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()
A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...
kernel: ice: fix double-free of tx_buf skb
A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...
kernel: sctp: purge outqueue on stale COOKIE-ECHO handling
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...
kernel: zram: fix use-after-free in zram_bvec_write_partial()
A flaw was found in the Linux kernel, specifically within the zram module. This vulnerability is a use-after-free error, where the system attempts to use a piece of memory after it has been freed. This occurs when the zrambvecwritepartial function allows an asynchronous read to write into a page...
Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
kernel: netfilter: flowtable: publish GC-visible tuple last
A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...
CVE-2026-106269
An use after free flaw was found in the CSS component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=565742178 https://code.google.com/p/chromium/issues/detail?id=106269...
openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service
A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...
Important: Red Hat Security Advisory: openssh security update
An update for openssh is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side
A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...
uaf-2023-28205
CVE-2023-28205: Apple WebKit の Use-After-Free 脆弱性 この脆弱性は、悪意を持って作成された Web コンテンツを通じて悪用される可能性があり、攻撃者が任意のコードを実行できるようになります。 説明 このコードは、Map オブジェクトと Date オブジェクトの追加を遅延させることで use-after-free UAF 脆弱性を引き起こし、ガベージコレクター GC がそれらを解放できるようにします。これにより、解放されたオブジェクトにアクセスされる可能性が生じ、メモリ破壊を引き起こしたり、エクスプロイトを可能にしたりする可能性があります。 参...
GhostLock
GhostLock - CVE-2026-43499 本地提权漏洞利用 漏洞概述 CVE 编号： CVE-2026-43499 漏洞类型： futex PI（优先级继承）栈 UAF（Use-After-Free） 影响范围： Linux 内核 6.1 6.12（Android GKI） 利用效果： 本地提权 + SELinux 禁用，获取 root shell 工作原理 漏洞触发路径 用户空间 → pselect → 内核栈上分配 rtmutexwaiter → futex PI 操作触发 waiter 释放 → 释放后的 waiter 内存被 fdset 操作重用 → 通过精心构造的...
kernel-CTF
内核 CTF 挑战 一系列用于学习内核安全概念的 Linux 内核漏洞利用挑战。 环境要求 Linux 系统（已在 Ubuntu 上测试） 构建工具（gcc、make） 与你的内核版本匹配的 Linux 头文件 sudo apt-get update sudo apt-get install build-essential linux-headers-$uname -r 挑战内容 第 1 关：基础缓冲区溢出 内核模块漏洞利用入门 简单的缓冲区溢出漏洞 适合初学者的起点 位于 /level1 目录 第 2 关：释放后使用 更高级的内核漏洞利用 笔记系统中的释放后使用漏洞 介绍内核堆的概念 ...
