kernel: smb: client: fix query_info() replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...

kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker ...

kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

A flaw was found in the Linux kernel's RDMA/rxe component. The rxercv function does not adequately validate the BTH pad and ICRC fields of incoming packets before calculating the payload size. A remote attacker could exploit this by sending a specially crafted short packet or a packet with a forg...

CVE-2026-98173

A flaw was found in the Linux kernel's SMB client. A race condition in multichannel connection management allows network interface structures to be freed while still in use during concurrent interface refreshes. A malicious server or an attacker triggering interface updates can exploit this...

CVE-2019-14041

CVE-2019-14041 Proof-of-concept code for CVE-2019-14041 More details about the vulnerability are available in the blog post. If you have any questions, you are welcome to DM me on Twitter @tamirzb. Build & Run In order to build, run Android NDK's ndk-build. In order to run the PoC, make sure to r...

CVE-2024-30090

CVE-2024-30090 - LPE PoC CVE-2024-30090 found by Angelboy with DEVCORE. Parent.cpp Get the ntoskrnl base by using NtQuerySystemInformation medium-integrity - Compile as x64. Child.cpp The exploit for CVE-2024-30090 - Compile as x86. Thanks Big thanks Angelboy for your help and guidance!. Cedric...

CVE-2025-62470

This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME: ConsoleApplication4.exe...

kernel: vsock/vmci: fix UAF when peer resets connection during handshake

A flaw was found in the vsock/vmci component of the Linux kernel. A remote attacker could exploit a Use-After-Free UAF vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being le...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: packet: use consistent hard_header_len in non-ring send paths

An out-of-bounds write problem was observed in packetsendmsgspkt in net/packet/afpacket.c in the Linux Kernel. In this flaw, AFPACKET hardheaderlen race may allow local privilege escalation...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

kernel: sctp: purge outqueue on stale COOKIE-ECHO handling

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending...

kernel: udf: fix partition descriptor append bookkeeping

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could exploit this vulnerability by tricking a user into mounting a specially crafted UDF image containing repeated partition descriptors. This could lead to a heap out-of-bounds write, potentially...

kernel: fs/notify: call exportfs_encode_fid with s_umount

A flaw was found in the Linux kernel’s filesystem notification fs/notify code where calling inotifyshowfdinfo on a file descriptor watching an overlayfs inode during an unmount operation could lead to a NULL pointer dereference...

kernel: af_unix: Unlink scc_entry in unix_del_edge()

A flaw was found in the Linux kernel's afunix component. A race condition during concurrent send and close operations can lead to the garbage collector GC partially freeing a Strongly Connected Component SCC. This inconsistent state may cause subsequent GC operations to iterate over a partially...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: smb: client: fix double-free in SMB2_flush() replay

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

kernel: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data()

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance IOAM functionality. A remote attacker can send a specially crafted packet that manipulates the nodelen field while processing trace data. This manipulation leads to a heap buffer overflow, causing...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...