CVE-2026-23398

CVE-2026-23398 Linuxカーネル icmptagvalidation ヌルポインタ参照（リモートDoS） 説明 net/ipv4/icmp.c の icmptagvalidation は、inetprotosproto をNULLチェックなしで参照します。リモートの攻撃者は、未登録の内部プロトコル番号を持つ単一の細工されたICMP Fragmentation Neededパケットを送信することで、softirqコンテキストでカーネルをクラッシュさせることができます。 影響を受けるバージョン: コミット 614aefe56af8（mainline）/...

copy-fail_LPE_Interactive

CVE-2026-31431 Copy Fail Exploit Linux カーネルの page cache 汚染脆弱性を利用したツールで、非対話型コマンド実行をサポートします。 脆弱性の概要 CVE-2026-31431 は、Linux カーネルの authencesn AEAD アルゴリズム実装に存在する論理的欠陥です。AFALG と splice システムコールチェーンを介して、攻撃者は任意の読み取り可能ファイルの page cache に 4 バイトのデータを書き込むことができます。 影響範囲: Linux カーネル 4.14+ 2017年 - 2026年4月...

CVE-2026-31431

CVE-2026-31431 LPE PoC（Rust実装） このプロジェクトは、ローカル権限昇格（LPE）の脆弱性（CVE-2026-31431を模擬）に対するRustで実装されたProof of Concept（PoC）です。Crypto APIを悪用してLinuxカーネルのページキャッシュを操作する方法を示しています。cite: 1, 2 !CAUTION...

kur

kur 이 코드는 서명된 취약한 드라이버를 이용해 사용자 모드에서 커널 모드 메모리를 읽고 쓸 수 있는 기능을 제공합니다. 커널 모드에서 문서화되지 않았지만 가장 흔한 API 중 하나인 MmCopyVirtualMemory를 사용하여, 메모리 페이지의 보호 속성에 신경 쓸 필요 없이 모든 사용자 모드 메모리를 읽고 쓸 수 있습니다. 그 외에도 주어진 pid의 프로세스 핸들을 얻는 부가 기능이 있습니다. 핸들 생성이 커널 모드에서 수행되므로 표준 접근 검사와 콜백은 작동하지 않을 것이라고 생각합니다. 이 프로젝트는 학습 목적으로...

CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits 이 저장소는 침투 테스터와 레드 팀 전문가를 위해 특별히 설계된 포괄적인 익스플로잇 및 문서 모음을 제공합니다. Linux Dirty Pipe 취약점을 효과적으로 악용하려는 사람들에게 귀중한 자료가 됩니다. 취약점 정보 Dirty Pipe CVE-2022-0847는 Linux 커널에서 발견된 로컬 권한 상승 취약점입니다. 이 보안 결함으로 인해 권한이 없는 사용자가 다음과 같은 여러 중요한 작업을 수행할 수 있습니다: /etc/passwd와 같은 임의의 읽기 전용 파일...

kernel: nvme-tcp: reject a read that transferred too few bytes

A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data,...

kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit PMTU check. When the packet's head is modified during the PMTU check, the old cached IP header point...

kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul

A flaw was found in the Linux kernel's netfilter SIP Session Initiation Protocol connection tracking module. This vulnerability, caused by unsafe port parsing, allows a remote attacker to send specially crafted malformed packets. Such packets could lead to excessive resource consumption,...

kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

A flaw was found in the Linux kernel's Bluetooth hciuart component. Lifecycle management issues, including Use-After-Free UAF and race conditions, were identified during the closing and initialization paths. These issues can lead to the dereferencing of freed memory, potentially causing system...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

A flaw was found in the Linux kernel's tunnels module. This vulnerability, categorized as a Use-After-Free UAF, arises from improper handling of network header pointers during certain packet processing operations. Specifically, functions responsible for building Internet Control Message Protocol...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for arm64 architectures. An issue in the reallocation of the nestedmmus array allows a process to access freed memory. This memory corruption vulnerability could enable a local attacker to escalate privileges or cause a denia...

kernel: KVM: s390: vsie: zero stale crypto bits

A flaw was found in the Linux kernel's KVM s390 Virtual Shared Inter-Partition Emulation VSIE component. When shadowing crypto access bits from a format0 apcb, stale crypto bits were not properly cleared. This oversight could allow a nested guest to potentially access a device that should no long...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. When processing Internet Control Message Protocol ICMP errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet,...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

kernel: ipv6: add NULL checks for idev in SRv6 paths

A flaw was found in the Linux kernel. Missing null pointer checks in the IPv6 Segment Routing SRv6 implementation, specifically within the seg6hmacvalidateskb and ipv6srhrcv functions, can occur when an IPv6 device lacks proper configuration. This oversight may allow an attacker to trigger a null...

kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation

A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2ioctl replay path, where a response buffer can be freed twice under specific error conditions. A malicious or compromised SMB server could exploit this by sending crafted response...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...