Linux_LPE_io_uring_CVE-2021-41073

LinuxLPEiouringCVE-2021-41073 CVE-2021-41073 iouring 타입 혼동 취약점에 대한 LPE 익스플로잇입니다. 라이팅writeup은 Put an iouring on it: Exploiting the Linux Kernel에서 확인하세요. 작성자: @chompie1337 교육/연구 목적으로만 사용하세요. 테스트나 보안 평가에는 사용하지 마세요. 빌드 방법 liburing 필요: gcc -o hello hello.c -Wall -std=gnu99 pkg-config fuse --cflags...

CVE-2023-5178

CVE-2023-5178 다음에 대한 익스플로잇: CVE-2023-5178: NVMe-oF-TCP 취약점, 이는 손상된 Initialize Connection Request를 처리하는 과정에서 NVMe-oF-TCP 드라이버의 논리 오류입니다. 이로 인해 kmalloc-96에서 레이스 조건에 의한 이중 해제double-free가 발생하며, LPE를 획득하는 데 악용될 수 있습니다아래 데모 참조. 익스플로잇은 6.5.0-9-generic 커널이 탑재된 Ubuntu 23.10영향을 받는 최신 커널 버전을 대상으로 합니다. 이전 v6...

UBUNTU-CVE-2026-97929

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

UBUNTU-CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

EUVD-2026-86908

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

EUVD-2026-86783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-

CVE-2026-11108 – 메모리 할당기Integer Overflow의 정수 오버플로우 kmalloc Sim 프로그램 코드 C // allocsim.c - Vulnerable memory allocator include include include define MAXBLOCK 1024 void mymallocsizet size sizet total = size + sizeofsizet; // header if total MAXBLOCK return NULL; void ptr = malloctotal; if !ptr retu...

Linux Distros Unpatched Vulnerability : CVE-2026-98078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1...

PT-2026-98569

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreq policy alloc allocates policy-cpus with alloc cpumask var, i.e. without GFP ZERO, unlike the sibling related cpus and real cpus masks. With CONFIG CPUMASK...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Rejects oversized global TT response buffers. The function batadvttpreparetvlvglobaldata calculates the allocation length for a global TT response using 16-bit temporary variables. When a remote originator advertises ...

SUSE CVE-2026-90307

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CentOS 9 : kernel-5.14.0-749.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-749.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session...

CVE-2026-90107

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

CVE-2026-90108

CVE-2026-90108 is a memory leak in the Linux kernel 's net/smc subsystem. When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK, it overwrites flow->qentry via smc_llc_flow_qentry_set() without first freeing a previously stashed ent...

EUVD-2026-81701

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...

CVE-2026-90307: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CVE-2026-90108: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...

CVE-2026-90107: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

DEBIAN-CVE-2026-90034

In the Linux kernel, the following vulnerability has been resolved: usb: image: mdc800: change kmalloc to kzalloc Change the kmalloc calls in usbmdc800init for irqurbbuffer and downloadurbbuffer to kzalloc, avoiding potential stack leaks if a shorter message is received in mdc800usbirq and...