hot-jar-swapping-urlclassloader

URLClassLoader hot jar swapping The following example code shows the ability to hot jar swap an already loaded JAR-file and get code execution by abusing the fact that inner classes still access the JAR file when invoked, as long as the inode does not change. Tested on MacOS with OpenJDK And also...

CVE-2022-2602

CVE-2022-2602 This repository contains exploits for CVE-2022-2602. There are two versions of it: Exploit using userfaultfd technique. Exploit using inode locking technique. Enjoy! : LukeGix...

VQ-RefluxCore

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Framework VQ-RefluxCore is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation LPE mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities...

CVE-2026-99137

The Linux kernel contains a vulnerability in the CIFS filesystem where the i_size is incorrectly updated in cifs_do_truncate when a cached handle is missing. Specifically, if find_writable_file() returns null, the system might set i_size to 0 even if the server-side truncation fails, leading to a...

PT-2026-128130

In the Linux kernel, the following vulnerability has been resolved: cifs: don't update i size in cifs do truncate without a cached handle If find writable file returns null, cifs file flush will return 0 without issuing set file size, and the outer 'if !rc' block will set i size to 0 before telli...

Linux Distros Unpatched Vulnerability : CVE-2026-98961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock an...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

kernel: procfs: avoid fetching build ID while holding VMA lock

A deadlock vulnerability was found in the procfs PROCMAPQUERY ioctl handler. When fetching the optional build ID while holding the VMA lock mmaplock, a circular lock dependency can occur with the inode mutex, causing a system deadlock...

CVE-2026-99084

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-98961 btrfs: unlock inode and extent in caller when io_uring read extent fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.13. It arises because btrfs fails to unlock inodes and extents within the caller when an iouring read of an extent fails; similarly, it fails to unlock these resources when page array allocation returns -ENOMEM...

PT-2026-122044

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix local root reference leak in scrub print warning inode When paths from inode fails, scrub print warning inode jumps to err without dropping the reference taken by btrfs get fs root, leaking a reference to the ro...

PT-2026-122057

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear inode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.1. It stems from holding an inode lock for too long when reading from an immutable directory. Attackers can delay the getdents response via FUSE mounting, thereby blocking directory lookup, creation, and mounting operations, leading to a...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

CVE-2026-115395 Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space...

CVE-2026-115395

Ghidra versions 10.3 before 12.2 are vulnerable to a resource allocation without limits flaw in ThemeReader.readZipTheme() . This vulnerability allows an attacker to cause a denial of service by persuading a user to import a crafted theme ZIP archive containing a massive number of small files. Th...

CVE-2026-115395 Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme()

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space...