kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul

A flaw was found in the Linux kernel's netfilter SIP Session Initiation Protocol connection tracking module. This vulnerability, caused by unsafe port parsing, allows a remote attacker to send specially crafted malformed packets. Such packets could lead to excessive resource consumption,...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A race condition exists during the handling of new Bluetooth connections, where a newly created socket can be prematurely freed by another process before a callback function completes its operation. This use-after-free vulnerabilit...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock()

A flaw was found in the Linux kernel’s TLS implementation net/tls/tlsdevice.c. The function getnetdevforsock is invoked during setsockopt, which is not executed under RCU Read-Copy-Update protection. It previously used skdstgetsk-dev, which can lead to a use-after-free UAF if the sk’s destination...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

A flaw was found in the Linux kernel's tunnels module. This vulnerability, categorized as a Use-After-Free UAF, arises from improper handling of network header pointers during certain packet processing operations. Specifically, functions responsible for building Internet Control Message Protocol...

CVE-2026-31431-poc

Wrapper de PoC de comando Copy Fail Un pequeño wrapper de prueba de concepto modificado para Copy Fail / CVE-2026-31431 que permite pasar un comando personalizado desde la terminal en lugar de lanzar siempre un shell root interactivo, para que pueda ejecutarse en un entorno no interactivo como un...

copyfail-rs

copyfail-rs Implementación en Rust de CVE-2026-31431 Copy Fail — una primitiva de escritura en la caché de páginas del kernel de Linux mediante AFALG splice. 中文文档 / Chinese README CVE-2026-31431 La implementación de algifaead del kernel de Linux permite a un usuario sin privilegios escribir datos...

Dirty-Frag-Analysis

Análisis técnico en profundidad de Dirty Frag CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC Vulnerabilidades de escalada de privilegios locales en el kernel de Linux — Reversing del PoC · Desglose del shellcode · Principios del parche · Script de detección Resumen de la vulnerabilidad Dirty Frag...

CVE-2026-31431

CVE-2026-31431 - PoC de Copy Fail Prueba de concepto educativa para CVE-2026-31431 , también conocida como Copy Fail , una vulnerabilidad de escalada de privilegios local en el kernel de Linux que involucra la interfaz criptográfica AFALG / algifaead. !WARNING Este repositorio se proporciona...

CVE-2024-0070-NVIDIA-GPU-Driver--Resonance-Vulnerability

CVE-2024-0070-Controlador-GPU-NVIDIA--Vulnerabilidad-de-Resonancia Los controladores de GPU de NVIDIA tienen una falla de coherencia temporal en su gestión de memoria. Con una resonancia de 587 kHz, las páginas de memoria del controlador experimentan interferencia de desintegración α, lo que...

CVE-2026-31431

Autor: 0xShe Idioma / 语言 English: https://github.com/0xShe/CVE-2026-31431/blob/main/README.md 中文: https://github.com/0xShe/CVE-2026-31431/blob/main/README-CN.md Guía de la herramienta de escalada de privilegios del kernel CVE-2026-31431 0x01 Inicio rápido Algunos entornos objetivo no tienen Pytho...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. Infraestructura C2: servidores resilientes y redundantes El análisis de memoria con Process Hacker revela una lista completa de dominios utilizados por el Dropper GCleaner para la comunicación C2. Estos dominios están alojados en varias plataformas Scaleway, Render, Replit, etc., lo que indica...

lg-webos-kexec

lg-webos-kexec Arranca un kernel Linux personalizado en un TV LG webOS rooteado mediante kexec — en RAM, sin bypass de arranque seguro. Estado: trabajo en curso. Un kernel personalizado puede prepararse y llega al espacio de usuario, pero todavía no se mantiene activo como un SO utilizable...

ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: uid=0root gid=0ro...

ksmbrace

ksmbrace Investigación de vulnerabilidades en ksmbd , el servidor SMB3 del kernel de Linux fs/smb/server/. Fallos de atacante autenticado en las rutas de identificador durable y de resolución de rutas de ksmbd. El nombre alude al tema de la condición de carrera de esta línea de trabajo ver el UAF...

CVE-2026-53365

CVE-2026-53365 — VsockDrop: subdesbordamiento del contador de referencias en iouring + AFVSOCK zero-copy, escalada de privilegios mediante reescritura de Page-Cache Imagen de distribución de HackSpeak. Este repositorio es un espejo de distribución de MaherAzzouzi/vsockdrop , con el código idéntic...