CVE-2026-89783

A flaw was found in the Linux kernel's IPv6 networking component. An error in handling security path depth could allow an out-of-bounds write. A remote attacker could exploit this by sending specially crafted IPv6 packets, leading to a system crash and causing a Denial of Service DoS. Mitigation...

CVE-2026-89779

A flaw was found in the Linux kernel's ntfs3 filesystem driver. This vulnerability allows a local attacker to craft an Extended Attribute EA record with an undersized ef-size value. When processed, this can lead to an out-of-bounds read, resulting in the disclosure of sensitive heap memory to...

CVE-2026-90011

A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol CHAP. This can lead to an out-of-bounds read,...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

DirtyAH6

DirtyAH6 CVE-2026-80844 Writeup !WARNING The PoC is provided solely to help defenders, maintainers, and authorized security teams validate patches, mitigations, detections, and exposure on systems they own or are explicitly authorized to test. You are solely responsible for ensuring that your use...

copyfail

Copy Fail CVE-2026-31431 – Exploit Usage Guide Original Readme taken from @painoob All Kernel versions since 2017 / 2016 are vulnerable ! Kernel 7 is fully immune, others between 5-7 may still be vulnerable ⚠️ Disclaimer This content is for educational and authorized security testing purposes only...

CVE-2026-64561-Kernel-Fix

中文 | English 中文 升级 Linux Kernel 修复 CVE-2026-64561 教程 声明： 本文仅记录本人服务器环境下的修复过程，并非安全专业分析。如有不当之处，欢迎指正。 一、简介 本文档提供两种方式将 Linux Kernel 升级，用于修复 CVE-2026-64561 ：ELRepo RPM 安装（推荐）和源码编译。 项目| 说明 ---|--- CVE 编号| CVE-2026-64561 漏洞组件| Linux Kernel KVM/x86 修复方式| 升级 Linux Kernel（ELRepo RPM 或源码编译） 三、升级方法...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf bsc1272386. CVE-2026-68158: libceph: Fix multiplication overflow in...

SUSE-SU-2026:4708-1 Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf bsc1272386. - CVE-2026-68158: libceph: Fix multiplication overflow in...

CVE-2017-6074-DOS

CVE-2017-6074 - DoS-Only Exploit Linux DCCP kernel panic This repository provides a modified version of the original CVE-2017-6074 exploit use-after-free in the Linux kernel DCCP subsystem, designed only to demonstrate Denial of Service DoS impact. An authenticated local user can trigger a kernel...

kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI synchronization. A local user could trigger a stack buffer overflow by binding a specific type of Bluetooth socket with an excessive number of Bluetooth Isochronous Stream BIS entries. This memory corruption can lead t...

kernel: Bluetooth: MGMT: validate LTK enc_size on load

A flaw was found in the Linux kernel's Bluetooth management MGMT component. An attacker could exploit a vulnerability in how Long Term Keys LTK are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service...

kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()

A flaw was found in the Linux kernel's nfnetlinkcthelper component. This vulnerability, an out-of-bounds read, occurs in the nfnlcthelperdumptable function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could...

kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show()

A flaw was found in the Linux kernel's SCSI target subsystem. This vulnerability, a buffer overflow, occurs in the tgptgpmembersshow function when processing long iSCSI IQN names. An attacker could potentially exploit this by providing a specially crafted input, leading to the disclosure of...

kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

A flaw was found in the Linux kernel, specifically within the RDMA Remote Direct Memory Access vmwpvrdma module. This vulnerability is a double free, which means the system attempts to release the same memory resource twice. This can occur in an error handling path within the pvrdmaallocucontext...

kernel: ipv6: validate extension header length before copying to cmsg

A flaw was found in the Linux kernel's IPv6 networking stack. An unprivileged local user could exploit a vulnerability in how IPv6 extension header lengths are handled. By manipulating these headers using nftables, an attacker can trigger an out-of-bounds read, leading to information disclosure...

kernel: ipv6: exthdrs: refresh nh after handling HAO option

A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option HAO, the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value TLV options,...

kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit PMTU check. When the packet's head is modified during the PMTU check, the old cached IP header point...