EtwLeakKernel

EtwLeakKernel Este repositorio contiene un PoC para un programa que utiliza ETW para filtrar direcciones de memoria del kernel. Lo hace creando un consumidor podría ser para casi cualquier proveedor, ya que casi todos filtran direcciones del kernel y solicitándole un seguimiento de pila. Una vez...

CVE-2024-26160

CVE-2024-26160 vulnerabilidad de divulgación de información en cldflt.sys Hay un pequeño análisis sobre CVE-2024-26160 , que se puede encontrar en el parche de febrero KB5034765 , Windows 11 22H2, Windows 11 23H2. La vulnerabilidad se cerró en el parche de marzo KB5035853. Análisis La...

CVE-2023-26083

CVE-2023-26083 – Mali GPU Kernel Address Leak via Timeline Stream This repository contains a proof-of-concept PoC exploit for CVE-2023-26083 , a vulnerability in the Mali GPU driver Arm Mali GPU Kernel Driver that allows an unprivileged user to leak kernel pointers and sensitive internal...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE PoC educativo ADVERTENCIA: Este repositorio se proporciona únicamente con fines educativos y de investigación. No se distribuyen binarios precompilados ni versiones. Debes compilar todo desde el código fuente. Escalación de privilegios local en Android 16 para...

CVE-2023-2598

CVE-2023-2598 Referencias: https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ Compilación: root@kitploit: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring Prueba de concepto:...

CVE-2026-90220

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2026-90220 ALSA: seq: Don't leak the extension cell pointer in the bounce payload

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

CVE-2025-24990_POC

Controlador de módem Agere de Windows ltmdm64.sys. Este controlador es muy antiguo y no se carga de forma predeterminada en mi máquina de pruebas, por lo que lo explotaré en un escenario BYOVD. Curiosamente, según mi investigación, este controlador ha existido desde Windows 7 y tiene al menos un...

AZL-101672 CVE-2026-89984 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

EUVD-2026-80584

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

Linux Distros Unpatched Vulnerability : CVE-2026-89984

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: nvmet-tcp: bounds checks were added in nvmettcpbuildpduiovec. The nvmettcpbuildpduiovec function could exceed cmd-req.sg when the PDU length or offset exceeded sgcnt, and then use bogus values of sg-length/offset. This led to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/siw: Fixed a potential NULL pointer dereference during header processing. If siwgethdr returns -EINVAL before setrxfpducontext, qp-rxfpdu can be NULL. The error path in siwtcprxdata dereferences qp-rxfpdu-moreddpsegs...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sched/taskstack: fixed the objectisonstack function for KASAN-tagged pointers When CONFIGKASANSWTAGS and CONFIGKASANSTACK are enabled, the objectisonstack function may produce incorrect results due to the presence of tags in the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dm raid: fixed the KASAN warning in raid5adddisks. There is a KASAN warning in raid5adddisk when running the LVM testsuite. The warning occurs during the test lvconvert-raid-reshape-lineartoraid6-single-type.sh. We fixed this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Use VMMAP instead of VMALLOC for the ringbuf area. After the commit 2fd3fb0be1d1 “KASAN, vmalloc: Unpoison VMALLOC pages after mapping”, non-VMALLOC mappings will be marked as accessible in getvmareanode when KASAN is enable...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fixed an MTE false alarm in dokrealloc. This patch addresses an issue introduced by commit 1a83a716ec233, which caused MTE Memory Tagging Extension to falsely report a slab-out-of-bounds error. The problem occurs wh...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Allocate sufficient space for GMU registers In commit 142639a52a01 “drm/msm/a6xx: fix crashstate capture for A650”, we changed a6xxgetgmuregisters to read 3 sets of registers. Unfortunately, we did not change the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: cachefiles: fixed a slab-use-after-free in fscachewithdrawvolume We encountered the following issue during our fault injection stress test: ================================================================== BUG: KASAN:...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Avoid invalid reads in irdmanetevent. The irdmanetevent function should not dereference anything from “neigh” alias “ptr” until it has checked that the event is of type NETEVENTNEIGHUPDATE. Other events are pointed to...