Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem, specifically within the SEV Secure Encrypted Virtualization feature. A malicious guest operating system utilizing SEV-SNP Secure Nested Paging can exploit an out-of-bounds write vulnerability due to improper...

kernel: igc: set tx buffer type for SMD frames

A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: nfsd: fix stale s2s_cp_stateids IDR entry for async COPY

A flaw was found in the Linux kernel's Network File System Daemon nfsd component. When performing an asynchronous async copy operation, a programming error causes a stale identifier IDR entry to point to memory that has already been reused. This can lead to memory corruption, where the system...

kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...

kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker

A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...

kernel: nfsd: fix UAF in async copy cancel and shutdown

A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free UAF vulnerability. This allows an async copy object to be freed or used after being freed, potentially causing memory...

kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup

A flaw was found in the Linux kernel's Network File System Daemon NFSD. The nfsd4decodesecinfononame function does not properly initialize a pointer sinexp before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from...

CVE-2026-84543

Preuve de concept Cette preuve de concept devrait provoquer un kernel panic et redémarrer un Mac affecté. Les builds de test affectés utilisés lors de la recherche étaient macOS Tahoe 26.4 25E246 et macOS 26.5 bêta 4 25F5068a. Apple a corrigé CVE-2026-84543 dans macOS Golden Gate 27, Tahoe 26.7 e...

EUVD-2026-95084

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

CVE-2026-106177 HP Sure Click Kernel Buffer Overflow

A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability...

CVE-2026-106177

A kernel buffer overflow vulnerability exists in HP Sure Click versions prior to 4.4.33 . This flaw could potentially allow an attacker to achieve local privilege escalation or perform arbitrary code execution . HP has released version 4.4.33 to remediate this issue. No specific exploit details o...

windows_kernel_shadow_stack

إثباتات المفاهيم يهدف هذا المشروع إلى إبراز جوانب معينة من تخفيف حماية المكدس الظل shadow stack المطبَّق من مايكروسوفت في ويندوز 11. الكود مخصص تحديدًا لإصدار ويندوز 11 24H2. قد لا يعمل على إصدارات أخرى من ويندوز 11، بسبب إدارة إزاحات النواة kernel offset management. ينقسم المشروع إلى جزأين: عميل...

samsung-q60t-exploit

استغلال Tizen الوصف سكربت استغلال وفك تشفير البرنامج الثابت تم تقديمه في Grehack 2021. الشرائح متاحة داخل دليل slides وفيديو الإعادة على Youtube . الدلائل يحتوي هذا المستودع على ثلاثة دلائل: exploit/: يحتوي على استغلال v8 واستغلال النواة، firmware/: يحتوي على سكربت فك تشفير البرنامج الثابت slides...

nmap-farewell

nmap-farewell تهدف هذه الأداة إلى إظهار قدرات ميزة nfnetlinkqueue في نواة لينكس. لمزيد من المعلومات المتعمقة، يمكنك قراءة هذا المقال. قبل أن تقوم النواة بإسقاط الحزم، يتم إرسالها إلى هذه الأداة لمزيد من المعالجة. إذا حاول نظير بعيد الوصول إلى عدد كبير جدًا من المنافذ المغلقة على جهازك، فسيتم حظره...

CVE-2025-39913

CVE-2025-39913 - Noyau Linux eBPF SOCKMAP UAF Auteur : Byte Reaper Ma plateforme :https://www.bytrep.com/ Description Ce dépôt contient une preuve de concept technique pour CVE-2025-39913, une vulnérabilité dans la fonction tcpbpfsendverdict du noyau Linux. Lorsque bpfmsgcorkbytes ne parvient pas...

PinTheft-go

pintheft-go Portage Go de pintheft — LPE double-free RDS zcopy. Membre de la classe de vulnérabilités Dirty Frag. !IMPORTANT Arch Linux est l'une des distributions les plus exposées à cette vulnérabilité, car elle fait partie des rares où le module RDS peut généralement être chargé par défaut...

DirtyFrag-go

dirtyfrag-go Deux bugs. Un shell. Aucune écriture disque. Portage Go de dirtyfrag CVE-2026-43284 / CVE-2026-43500. Comment ça marche tl;dr La classe de bug se trouve dans le sous-système XFRM du noyau Linux. Lorsqu'une page de fichier est spliceée dans un pipe puis dans un socket chiffré ESP, le...

CVE-2026-31431

🐞 CVE-2026-31431 - Copy Fail Un défaut logique dans authencesn enchaîné via AFALG et splice en une écriture contrôlée de 4 octets dans le cache de pages de tout fichier lisible du système. Pas de condition de course, pas d'offsets, pas de payload compilé. Le même script de 732 octets obtient les...