CVE-2026-98381 veth: manage XDP program pointers during channel resize

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

CVE-2026-98382 bpf: Reject dev-bound-only programs on other devices

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98382

The Linux kernel contains a vulnerability where bound-only BPF programs can incorrectly match sibling ports due to a fallback mechanism in __bpf_offload_dev_match(). Because these programs typically have NULL offdevs , unrelated netdevs can compare as equal on offload-registered netdevs. An attac...

EUVD-2026-95537

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98380

A vulnerability exists in the Linux kernel 's net/sched component where tcf_idr_delete_index() fails to properly handle IDR error pointers . Specifically, if an unlocked classifier removes an action and reserves the same IDR slot with ERR_PTR(-EBUSY) between the lookup and deletion, the system tr...

EUVD-2026-95535

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98379 netfilter: ip6t_rpfilter: reject routes without inet6_dev

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

PT-2026-108768

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpf offload dev match falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal...

PT-2026-108767

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth set channels tears down XDP resources for removed RX queues without clearing rq-xdp prog. If the program is then detached or replaced, those queues keep the old pointer...

PT-2026-108765

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t rpfilter: reject routes without inet6 dev ip6 route lookup can return an error-free route whose rt6i idev is NULL. Lowering an external nexthop device's MTU below IPV6 MIN MTU tears down its inet6 dev while fib6...

RowHammer-Exploit

RowHammer-Exploit RowHammer Based-Exploitbackdoor syssuid using rowhammer Still needs work... figure why stuff doesn't work properly... Current stage... Denial fails with the following stack trace... UG: unable to handle kernel paging request at 0000000100000000 PGD 8000000006de3067 P4D...

cve-2026-23398-poc

Lab: CVE-2026-23398 ICMP / ipnopmtudisc=3 Reproducible lab for the Linux kernel bug in icmptagvalidation NULL dereference when net.ipv4.ipnopmtudisc = 3 and a Fragmentation Needed ICMP arrives whose quoted inner IPv4 header uses a protocol number with no handler in inetprotos. Authorized use only...

CVE-2026-84543

Proof of concept This proof of concept is expected to kernel-panic and reboot an affected Mac. The affected test builds used during research were macOS Tahoe 26.4 25E246 and macOS 26.5 beta 4 25F5068a. Apple fixed CVE-2026-84543 in macOS Golden Gate 27, Tahoe 26.7, and Sequoia 15.8. Included PoC...

CVE-2023-6931

CVE-2023-6931 Kernel Panic PoC for CVE-2023-6931 Description CVE-2023-6931 is a vulnerability in perfevent that leads to a heap buffer overflow caused by an integer overflow in the readsize of a group. What is a Performance Event perf event? perfevents is a performance monitoring and analysis...

kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

CVE-2019-14041

CVE-2019-14041 Proof-of-concept code for CVE-2019-14041 More details about the vulnerability are available in the blog post. If you have any questions, you are welcome to DM me on Twitter @tamirzb. Build & Run In order to build, run Android NDK's ndk-build. In order to run the PoC, make sure to r...

Linux Distros Unpatched Vulnerability : CVE-2026-98259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enable...

UBUNTU-CVE-2026-98373

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables movehugetlbpagetables optimizes mremap by advancing to the last entry in the page table when the source page table does not exist, either initially or after...