CVE-2024-27804

CVE-2024-27804 root@kitploit: ./build.sh ./panic.sh root@kitploit: paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3:...

flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow is a proof-of-concept exploit for CVE-2016-1827, which was patched in OS X El Capitan 10.11.5 and iOS 9.3.2. The vulnerability is a series of unchecked arithmetic operations on an untrusted length supplied from user space in the function...

CVE-2019-8852

CVE-2019-8852 A tfp0 bug for macOS 10.15.1 and below. Warranty Use it on your own risk. This will make you macOS panic. I build it for security researchers only. Current state Just a PoC, convert the vulnerability to a useful UAF. Tested on macOS 10.14.6 18G103 , MacBook Pro with 16 GB RAM. Credi...

CVE-2022-25636

CVE-2022-25636 This is my exploit for CVE-2022-25636. I tested it against Ubuntu 21.10 with kernel 5.13.0-30. Works about 40% of the time, in the other cases you likely get a kernel panic. The exploit might corrupt important data on heap, after an unsuccessful attempt it's best to reboot...

CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

CVE-2022-36946

CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...

CVE-2025-29338

CVE-2025-29338 — Security Advisory Buffer Overflow in NXP moal.ko Wi-Fi Kernel Driver woalsetupmoduleparam / parsecfggetline Field| Value ---|--- CVE ID| CVE-2025-29338 Severity| High CVSS v3.1 Score| 7.8 CVSS v3.1 Vector| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability Type| Stack-Bas...

GenEtherExploit

EN GenEtherExploit は、macOS の脆弱性 CVE-2023-40404 に対する Proof-of-Concept（PoC）エクスプロイトです。この PoC は IOKit API を利用して IOUserEthernetResource ネットワークサービスとやり取りし、システムのネットワークインターフェースを操作します。このエクスプロイトの目的は、イーサネットコントローラを作成および操作することで、脆弱性のある macOS システムで潜在的なカーネルパニックを実証することです。 免責事項...

IOHIDFamily-PoC-Research

CVE-2026-28992 — IOHIDFamily FastPathUserClient PoC セキュリティ研究リポジトリ。iOS 18.7.1 以前の IOHIDFamily の FastPathUserClient における競合状態を実証する 2 つの PoC アプリ。 ⚠️ どちらの PoC もカーネルパニックを引き起こし、デバイスが再起動します。事前に作業を保存してください。 脆弱性の要約 フィールド| 詳細 ---|--- CVE| CVE-2026-28992 コンポーネント| IOHIDFamily —...

CVE-2026-43499

CVE-2026-43499 — Linux 内核 Futex PI 释放后使用 漏洞 kernel/locking/rtmutex.c 中的 removewaiter 被慢速锁路径使用，同时也在 futexrequeue 调用 rtmutexstartproxylock 时用于代理锁回滚。 在代理锁场景下，waiter::task 并不是 current，但 removewaiter 错误地对 current 进行操作。这会导致三个问题： 1. rbtree 出队时没有持有 waiter::task::pilock。 2. 等待者任务的 piblockedon...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos Die Funktion sysctlcoalitiongetpidlist in bsd/kern/syscoalition.c verwendet die Funktion coalitiongetpidlist, um eine Liste von PIDs in einer Koalition zu sammeln. Diese Funktion gibt bei Erfolg die Anzahl der PIDs oder bei Fehlschlag einen negativen errno zurück...

CVE-2026-28992-IOHIDFamily-FastPathUserClient-Race-Conditions

CVE-2026-28992: Condizioni di gara in IOHIDFamily FastPathUserClient CVE-2026-28992 | Autore: Johnny Franks @zeroxjf Componente: IOHIDFamily Impatto: Un attaccante potrebbe causare la terminazione imprevista di un'app Descrizione: Una vulnerabilità di corruzione della memoria è stata risolta...

CVE-2026-43499-PoC-Scanner

CVE-2026-43499 PoC-Scanner Dieses Repository enthält einen Go-basierten Scanner und eine Proof-of-Concept-Implementierung für eine Linux-Kernel-Sicherheitslücke im Zusammenhang mit CVE-2026-43499. Das Projekt ist ausschließlich für Forschung, defensive Analyse und autorisierte Sicherheitstests...

ScreenOff

ScreenOff CVE-2026-52910 PoC di crash del kernel. riferimento: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation Cosa socket + SOATTACHREUSEPORTCBPF + setsockopt race condition. La tempesta di callback timerfd/epoll rallenta il percorso di ricezione. Sostituire il...

CVE-2023-6931

CVE-2023-6931 Kernel Panic PoC für CVE-2023-6931 Beschreibung CVE-2023-6931 ist eine Schwachstelle in perfevent, die zu einem Heap-Pufferüberlauf führt, verursacht durch einen Integer-Überlauf im readsize einer Gruppe. Was ist ein Performance-Ereignis perf event? perfevents ist ein vom Linux-Kern...

CVE-2026-80695

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

AZL-98075 CVE-2026-80695 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80625

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80604

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...