CVE-2022-21907-http.sys

CVE-2022-21907 - Doble liberación en el controlador http.sys CVE-2022-21907 - Doble liberación en el controlador http.sys Resumen Un atacante no autenticado puede enviar una solicitud HTTP con una cabecera de solicitud HTTP "Accept-Encoding" que desencadena una doble liberación en la lista de...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys versión 10.0.20348.825 root@kitploit: 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9...

CVE-2026-98090

The Linux kernel contains a vulnerability in the btrfs filesystem where btrfs_init_new_device() switches the latest_dev and s_bdev pointers from a seed device to a new sprout device. If chunk creation or sprout setup fails, the error path releases the new device without restoring these pointers. ...

EUVD-2026-86798

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

CVE-2018-4407

CVE-2018-4407 IOS/macOS kernel crash Usage: python CVE20184407.py IP/CIDR python CVE-20184407.py 192.168.1.1 python CVE20184407.py 192.168.1.0/24 1. find iphone nmap -sS -p 62078 --open 192.168.1.0/24 2. attack python CVE20184407.py iphoneip...

kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released

A use-after-free vulnerability was identified in the Linux kernel framebuffer console fbcon subsystem. During framebuffer unregistration, the kernel freed the memory for a display mode but did not clear the corresponding fbdisplayi-mode pointer. Subsequent framebuffer ioctl operations could then...

CVE-2021-30955-POC

CVE-2021-30955 POC Proof of concept wrapped into an iOS app for CVE-2021-30955 All credit to Jake James. His POC code used in this project can be found here. What is this? This demonstrates CVE-2021-30955, an iOS bug which allows an app in userspace to gain kernel-level permissions. In order to...

EUVD-2026-86029

In the Linux kernel, the following vulnerability has been resolved: btrfs: balance: fix potential bg lookup failure in btrfsmayallocdatachunk BUG Running btrfs balance can trigger a null-ptr-deref before relocating a data chunk when metadata corruption leaves a chunk in the chunk tree without a...

EUVD-2026-86131

In the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIGPPCKERNELPCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register 0. Both calldoirq and calldosoftirq use inline...

CVE-2026-93259

The Linux kernel contains a vulnerability in powerpc/irq when CONFIG_PPC_KERNEL_PCREL is enabled. The functions call_do_irq() and call_do_softirq() use inline assembly for stack switching but fail to include r2 in their clobber lists. Because r2 is no longer reserved for the TOC pointer in this m...

CVE-2026-93257

The Linux kernel contains a vulnerability in the fs-integrity component where BIP_CHECK flags are not properly checked before generating or verifying PI information . This flaw can cause the system to incorrectly handle non-PI metadata, leading to the generation of incorrect metadata and potentia...

EUVD-2026-86245

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix the lockless page-table walk in showpte showpte walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent ent...

CVE-2026-93216

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in mm/page_owner. The function print_page_owner_memcg() initially reads page->memcg_data but subsequently re-reads it locklessly in page_memcg_check(page) and PageMemcgKmem(page). If a page is concurrently freed an...

EUVD-2026-85945

In the Linux kernel, the following vulnerability has been resolved: mm/pageowner: use memcgdata snapshot to avoid TOCTOU in printpageownermemcg printpageownermemcg reads page-memcgdata via READONCE at the start to guard against tail pages and NULL data. However, it later re-reads page-memcgdata...

CVE-2022-26937

PoC de Caída del Sistema de Archivos de Red de Windows CVE-2022-26937 root@kitploit: nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a...

CVE-2018-4407

CVE-2018-4407 Bloqueo del kernel causado por escritura fuera de los límites en el código de manejo de paquetes ICMP de Apple CVE-2018-4407 para iOS 11.0，11.2，11.3.1...

check_icmp_dos-CVE-2018-4407-

Principio El principio consiste en hacer que otros campos del paquete "icmp" sean inválidos; cuando el kernel de macOS o iPhone los analiza, no se ha implementado la comprobación de tamaño, lo que provoca un crash. Dispositivos 1. Apple iOS 11 y versiones anteriores: todos los dispositivos 2. App...

CVE-2025-62470

Esto no es una explotación, solo una POC root@kitploit: BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME:...

kernel: mac802154: llsec: add skb_cow_data() before in-place crypto

A flaw was found in the Linux kernel's mac802154 IEEE 802.15.4 MAC security component. This vulnerability allows for data corruption and potential kernel crashes when cryptographic transformations are performed on shared network packet data without proper isolation. A remote attacker could exploi...

Linux Distros Unpatched Vulnerability : CVE-2026-97487

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset =...