CVE-2018-17182

CVE-2018-17182 Linux Kernel VMA-UAF Privilege Escalation Vulnerability CVE-2018-17182 About Google Project Zero security researchers released details and a proof-of-concept PoC exploit for a high-severity vulnerability in the Linux kernel present since kernel versions 3.16 through 4.18.8...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

CVE-2021-3493

CVE-2021-3493 Ubuntu OverlayFS Local Privesc Affected Versions Ubuntu 20.10 Ubuntu 20.04 LTS Ubuntu 19.04 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu 14.04 ESM Usage gcc exploit.c -o exploit ./exploit Description "Ubuntu specific issue in the overlayfs file system in the Linux kernel where it did no...

CVE-2022-0847-Exploit-Implementation

CVE-2022-0847-Exploit-Implementation This is a POC showing how to pop a reverse bash shell for arbitrary code execution on a foreign machine using CVE-2022-0847, "Dirty Pipe Exploit". This vulnerability only affects Linux kernel versions 5.8 or newer but was patched in versions 5.16.11, 5.15.25,...

tcconfig

.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...

ved-ebpf

VED-eBPF: Kernel Exploit and Rootkit Detection using eBPF VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code...

Dirty-Pipe

Dirty Pipe Exploit CVE-2022-0847 Overview This repository contains a Proof of Concept PoC exploit for the Dirty Pipe vulnerability CVE-2022-0847 , which affects Linux kernel versions 5.8 to 5.16. This vulnerability allows local privilege escalation by exploiting improper handling of pipe buffers ...

sgx-step

A Practical Attack Framework for Precise Enclave Execution Control SGX-Step is an open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX platforms in particular. SGX-Step consists of an adversarial Linux kernel driver and a small user-spa...

CVE-2026-98372

The Linux kernel contains a stack out-of-bounds (OOB) read vulnerability in the xfrm: iptfs component. The issue stems from the iptfs_skb_reset_frag_walk() function, which uses an unbounded loop to advance fragments without checking if the index exceeds the nr_frags limit. While one caller is pro...

CVE-2026-98371

The Linux kernel contains a vulnerability in the xfrm: iptfs component where an attacker can trigger an unprivileged kernel panic (DoS) . The issue occurs during runt reassembly when an inner packet is split across outer packets; if the first fragment contains fewer than 4 bytes, __input_process_...

CVE-2026-98369

The Linux kernel contains a vulnerability in the xfrm component related to how transport-mode packets are reinjected. When xfrm_trans_reinject was converted to a workqueue, it began running in process context without an RCU read lock , triggering RCU lockdep warnings during finish callbacks (like...

CVE-2026-98370

The Linux kernel contains a use-after-free vulnerability in the xfrm component during ALLOCSPI requests. The issue arises because xfrm_state_netlink() and xfrm_alloc_userspi() perform redundant alloc_compat() calls. For compatibility requests, this causes the translator to misinterpret the 228-by...

CVE-2026-98368

The Linux kernel contains a vulnerability in the ESP (Encapsulating Security Payload) protocol when handling the out-of-place output path (esp->inplace == false ). The issue arises because ESP mutates the skb frag array without properly downgrading zerocopy managed frags (SKBFL_MANAGED_FRAG_RE...

CVE-2026-98367

A vulnerability exists in the Linux kernel RDMA/siw component where a Use-After-Free (UAF) condition can occur. If siw_qp_modify() fails within siw_accept(), the state_lock is released before error path cleanup. This creates a race window where a concurrent ibv_modify_qp() call can transition the...

CVE-2026-98366

The Linux kernel RDMA/rxe driver contains a slab-use-after-free vulnerability in the rxe_rereg_user_mr() function. The root cause is that the driver reassigns the memory region's protection domain (mr->ibmr.pd ) before validating the IB_MR_REREG_ACCESS argument. If validation fails, the reassi...

CVE-2026-98364

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem during bundle creation. The functions xfrm_bundle_create() and xfrm_create_dummy_bundle() improperly read dst->dev into a local pointer without acquiring a device reference before passing it to xfrm_fill_dst()....

CVE-2026-98365

A vulnerability exists in the Linux kernel RDMA/rxe driver where integer overflow in the mr_check_range() function allows for out-of-bounds (OOB) access . Because the function uses wraparound-prone arithmetic to validate the range of registered Memory Regions (MR), a remote peer can craft an RDMA...

CVE-2026-98363

The Linux kernel contains a vulnerability in the arm_scpi firmware component. The function scpi_dvfs_get_info() failed to validate upper bounds on the opp_count received from the SCP firmware, only rejecting zero counts. Because the shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps...

CVE-2026-98362

The Linux kernel contains a vulnerability in the SCPI clock driver where dvfs_get_idx() fails to perform an upper bound check on the DVFS index. If the SCP firmware is buggy or provides stale values, it can return a large index that exceeds the info->opps range. This results in a KASAN Out-of-...

CVE-2026-98361

The Linux kernel contains a vulnerability in the RDMA/rxe driver where the rxe_check_pagefault() function failed to perform access permission tests, retaining only the HMM_PFN_VALID check. This allowed ODP write operations, such as RDMA WRITE and SEND payloads, to modify read-only pages (e.g., pa...