CVE_2019_2215

CVE-2019-2215 - Android Binder UAF Local Privilege Escalation A rewritten Proof-of-Concept / Local Privilege Escalation LPE exploit targeting CVE-2019-2215 , a Use-After-Free vulnerability in the Android Binder driver. I have provided the vulnerable kernel build in the vulnerablekernelbuilds...

CVE-2025-65264

CVE-2025-65264 Descripción En CPU‑Z 2.17 y anteriores y otros productos que usan el controlador CPU-Z con versión 1.0.6.1 y anteriores, el controlador ej. cpuz161.sys desreferenció un valor desde una dirección proporcionada por el usuario y lo escribió en el búfer del sistema suministrado por la...

CVE-2025-13834-A-Bluetooth-RFCOMM-Out-of-Bounds-Read-Vulnerability-in-Modern-Wireless-Devices

= doi.org/10.5281/zenodo.18323302 = orcid.org/0009-0007-7728-256X README.md: CVE-2025-13834 RFCOMM Bluetooth "Heartbleed" Exploitation Framework Author: Sastra Adi Wiguna Purple Elite Teaming Date: January 20, 2026 Version: 1.0 Full-System Replication License: RED TEAM USE ONLY Do not distribute...

CVE-2020-0069_poc

Description This repository contains the materials we used to investigate CVE-2020-0069 on a Xiaomi Redmi 6a with a Mediatek SoC MT6762M. There are three programs: kernelrw.c a C program allowing to read/write kernel memory poc.sh a shell script syscallhook.c a C library that can be used to trace...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 Hypervisor Detection Suite ➲ Project Overview SENTINEL-ROOT-AUDIT is a professional-grade security suite designed to audit kernel integrity and detect hypervisor-level interventions on the Honor Magic V2 SM8550. While the core vulnerability CVE-2025-38352 allow...

kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMICWRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMICWRITE...

PT-2026-108161

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description The WfpMonitor kernel driver contains an improper validation of user-supplied pointers. Specifically, certain METHOD NEITHER IOCTL handlers dereference user-controlled pointer...

CVE-2026-12166_CVE-2026-12167_CVE-2026-12168

Multiple Local Privilege Escalation Vulnerabilities in Little Orbit GFAC Driver GFACSysx64.sys | ---|--- CVE IDs| CVE-2026-12166, CVE-2026-12167, CVE-2026-12168 Vendor| Little Orbit Product| GamersFirst Anti-Cheat GFAC Driver GFACSysx64.sys Affected Versions| No version information is embedded in...

kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access subsystem, specifically within the rxe driver. A remote attacker could exploit this vulnerability by sending a specially crafted ATOMICWRITE request with a zero-byte payload. This improper handling of non-8-byte ATOMICWRITE...

CVE-2026-43805-PoC

CVE-2026-43805: IODMACommand State Race Analysis and PoC This is an analysis that found the missing state lock in Apple IOKit's IODMACommand::PerformOperationImpl through a macOS 26.5/26.6 kernel binary diff. In the vulnerable build, while PerformOperation is using the ready state and memory...

Apple IOKit DriverKit Race Condition

Apple IOKit contains a race condition that may allow an app to cause unexpected system termination or write kernel memory. The supplied analysis includes a sanitizer-checked proof of concept model of the reported DriverKit RPC state-handling flaw...

Exploit for Race Condition in Apple Ipados

CVE-2026-43805 — IOKit IODMACommand DriverKit RPC race A on...

EUVD-2026-93359

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-90107

A flaw was found in the Linux kernel's net/smc component. The smcllcflowstop function, responsible for stopping a flow, performs a blind memory reset without first freeing a pending queue entry. This can lead to a memory leak if a duplicate link message arrives during a specific timing window,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel up to version 6.3.1, a use-after-free issue in Netfilter’s nftables module arises when processing batch requests. This allows unprivileged local users to obtain root privileges. The issue occurs due to improper handling of anonymous sets...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: The issue of OOB access in ibmvfcdiscovertargetsdone has been fixed. A malicious or compromised VIO server can return a numwritten value in the discovertargets MAD response that exceeds maxtargets. This value is...

Astra Linux – Vulnerability in Linux, Linux 5.10

A guest can force the Linux netback driver to consume a large amount of kernel memory. This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Incoming data packets for a guest in the Linux kernel’s netback driver are buffere...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007loadencoder In go7007loadencoder, the variable bounce i.e., go-bootfw is allocated without subsequent deallocation. After the following call chain: saa7134go7007init | | - go7007bootencoder |...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In pptp: ensure that the minimum skb length is properly set in pptpxmit. - Commit aabc6596ffb3 “net: ppp: Add bound checking for skb data in pppsynctxmung” fixed pppsynctxmunge. We need a similar fix in pptpxmit; otherwise, ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mm/vmalloc: fixed vmalloc, which may return null if called with GFPNOFAIL. The commit a421ef303008 "mm: allow !GFPKERNEL allocations for kvmalloc" includes support for GFPNOFAIL, but it creates a conflict with the commit...