copy-fail_LPE_Interactive

CVE-2026-31431 Copy Fail Exploit Linux kernel page cache poisoning exploit tool with support for non-interactive command execution. Vulnerability Overview CVE-2026-31431 is a logic flaw in the Linux kernel, present in the authesn AEAD algorithm implementation. Through the AFALG and splice system...

CVE-2026-31431

CVE-2026-31431 LPE PoC Rust Implementation This project is a Proof of Concept PoC implemented in Rust for a local privilege escalation LPE vulnerability simulating CVE-2026-31431. It demonstrates how to manipulate the Linux kernel page cache by exploiting the Crypto API.cite: 1, 2 !CAUTION This...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's ip6gre and ip6erspan tunnel drivers. The changelink functions in these drivers do not adequately verify administrative capabilities CAPNETADMIN across different network namespaces. This allows a local attacker, who has CAPNETADMIN in one network namespace bu...

kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

A flaw was found in the Linux kernel's Bluetooth L2CAP component. A race condition exists during the handling of new Bluetooth connections, where a newly created socket can be prematurely freed by another process before a callback function completes its operation. This use-after-free vulnerabilit...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink

A flaw was found in the Linux kernel's VXLAN Virtual Extensible LAN implementation. A local attacker, with CAPNETADMIN network administration capability in one network namespace, could exploit an incorrect privilege check in the rtnl changelink path. This allows the attacker to modify the...

kernel: dm-integrity: don't increment hash_offset twice

A flaw was found in the dm-integrity component of the Linux kernel. This vulnerability arises from an error where a hashoffset variable is incremented twice, leading to incorrect memory access. A local attacker could exploit this issue to trigger a system crash, resulting in a denial of service...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock()

A flaw was found in the Linux kernel’s TLS implementation net/tls/tlsdevice.c. The function getnetdevforsock is invoked during setsockopt, which is not executed under RCU Read-Copy-Update protection. It previously used skdstgetsk-dev, which can lead to a use-after-free UAF if the sk’s destination...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul

A flaw was found in the Linux kernel's netfilter SIP Session Initiation Protocol connection tracking module. This vulnerability, caused by unsafe port parsing, allows a remote attacker to send specially crafted malformed packets. Such packets could lead to excessive resource consumption,...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: netfilter: nf_log: validate MAC header was set before dumping it

A flaw was found in the Linux kernel's netfilter logging component. This vulnerability occurs because the system does not properly check if a network packet's Media Access Control MAC header is valid before attempting to log it. A local attacker could send a specially crafted network packet,...

kernel: gfs2: Fix slab-use-after-free in qd_put

A flaw was found in the Linux kernel's GFS2 file system. During filesystem shutdown, quota data objects were freed without being properly removed from the Least Recently Used LRU list. This oversight could lead to a use-after-free vulnerability, where the system attempts to access memory that has...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: gfs2: add some missing log locking

A flaw was found in the Linux kernel's Global File System 2 GFS2 component. The gfs2logd function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion...