swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

CVE-2022-1015

CVE-2022-1015 id uid=1000d gid=1000d groups=1000d ./poc + unshare done table created: leaktable chain created: leakchain rule added Listening on port 9999 table created: leaktable chain created: leakchain rule added Listening on port 9999 kerneladdress: ffffffffb4a00000 kernelstack:...

CVE-2026-99075

A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while holding a pending reference count update for an inter-process communication node, the update is improperly dropped instead of being rescheduled. This desynchronizes internal states and prevents userspace fro...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 2.6.13. It stems from emtextchange failing to verify whether the algo array ends with NUL before passing it to textsearchprepare, potentially leading to out-of-bounds reads and kernel memory leaks...

CVE-2026-98697

A flaw was found in the Linux kernel's USB serial subsystem. A race condition during USB serial driver deregistration can result in a kernel memory leak. A local user with permissions to modify driver attributes can trigger this issue by writing to the dynamic identifier interface while the drive...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142708 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1683229770)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1683229770 advisory. - In unixscmtoskb of afunix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation o...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2023:1683146027)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2023:1683146027 advisory. - In unixscmtoskb of afunix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation o...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2loadcmd ‘tpm2loadcmd’ allocates a temporary blob indirectly via ‘tpm2keydecode’ but it is not freed in failure paths. This issue can be addressed by wrapping the blob with a cleanup helper...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: r6040: Fixed the kmemleak in the probe process and removed it. There is a memory leak reported by kmemleak: - Unreferenced object 0xffff888116111000 size 2048: comm “modprobe”, pid 817, jiffies 4294759745 age 76.502s Hex dump...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: fix bitmap leaks The RX/TX flow-control bitmaps rxfcpfvfbmap and txfcpfvfbmap are allocated by cgxlmacinit but never freed in cgxlmacexit. Unbinding and rebinding the driver therefore triggers kmemleak:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007loadencoder In go7007loadencoder, the variable bounce i.e., go-bootfw is allocated without subsequent deallocation. After the following call chain: saa7134go7007init | | - go7007bootencoder |...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Input: usbtouchscreen – Clamps datalen/xlen to the urb buffer size. The nexioreaddata function extracts datalen and xlen from a packed be16 header in the device’s interrupt packet. It then iterates through the packet-data0..xlen...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: scmi: Fixed the issue of a memory leak caused by the failure to remove generic power domains when the ofgenpdaddprovideronecell function fails during probing. If the ofgenpdaddprovideronecell function fails during...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel up to version 5.13.7, an unprivileged BPF program can extract sensitive information from kernel memory via a Speculative Store Bypass side-channel attack, as a specific preempting store operation does not necessarily precede a store operation containing an attacker-controlled...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: The shared page is not zeroed before being exposed to user space. The bnxtreallocucontext function allocates uctx-shpg using getfreepageGFPKERNEL. The buddy allocator does not zero pages without the GFPZERO parameter...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: media: imx: csc/scaler: fix v4l2ctrlhandler memory leak Free the memory allocated in v4l2ctrlhandlerinit upon release...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: scsi: ibmvfc: The issue of OOB access in ibmvfcdiscovertargetsdone has been fixed. A malicious or compromised VIO server can return a numwritten value in the discovertargets MAD response that exceeds maxtargets. This value is...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor using anoninodegetfd, which allocates a new fd, creates the anonymous file, and inserts it into the process fd table before returning to the...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Firmware is released in the brmfipciesetup error path. This prevents memory leaks if the brmfichipgetraminfo function fails. Note that the CLM blob is released in the device removal path...