ksmbd-n-day

README Dieses Repository begleitet meinen Forschungsartikel Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in dem ich einen POC für N-Days aus dem Jahr 2023 entwickle: CVE-2023-52440 und CVE-2023-4130. Ich stelle die Kernel-Konfiguration .config, ein Kernel-Startskrip...

CVE-2026-74704

A flaw was found in the Linux kernel. The schcake ACK filter, responsible for processing network packets, contains a vulnerability. A remote attacker could send specially crafted malformed IP packets. This could lead to the system logging excessive warnings or, under specific configurations, caus...

CVE-2026-74702

A flaw was found in the vhost-scsi component of the Linux kernel. This vulnerability allows a local attacker to cause a denial of service DoS by changing virtio feature bits after the vhost-scsi endpoint has been activated. Specifically, enabling the T10-PI feature after setup can lead to an...

CVE-2026-46242

CVE-2026-46242 — „Bad Epoll" Dieses Repository ist ein Bad-Epoll-Validator für aarch64-Kernel, basierend auf einem Exploit, der für x86 bereits existiert. Linux Kernel Local Privilege Escalation durchepoll Use-After-Free Race Condition Feld| Detail ---|--- CVE| CVE-2026-46242 Spitzname| Bad Epoll...

CVE-2026-74697

A flaw was found in the Linux kernel's bnxten driver. This vulnerability occurs when End of frame padding EOP on the AGG ring overlaps with subsequent data segments. On older network chips, if Relaxed Ordering RO is active, this overlap can cause valid data to be overwritten with zeros. This can...

CVE-2026-74696

A flaw was found in the Linux kernel's TCP Fast Open TFO implementation. During SOREUSEPORT listener migration, the system incorrectly accounts for pending TCP Fast Open requests. This can lead to a Denial of Service DoS by allowing an excessive number of Fast Open requests, potentially exhaustin...

Dirty-Frag

💥 CVE-2026-43284 — Dirty Frag 💥 ⚡ إثبات مفهوم لتصعيد الامتيازات المحلي عبر Dirty Frag ⚡ 📖 الوصف يحتوي هذا المستودع على إثبات مفهوم PoC لما يلي: CVE-2026-43284 — Dirty Frag يُظهر الاستغلال ثغرة تؤثر على أنظمة Linux الضعيفة. 🧠 حول Dirty Frag Dirty Frag يُشار إليها أحيانًا باسم Copy Fail 2 هي ثغرة...

CVE-2026-74694

A flaw was found in the Linux kernel's NCSI Network Controller Sideband Interface component. A local attacker with CAPNETADMIN capabilities could exploit a heap out-of-bounds OOB read vulnerability. By crafting a malicious NCSI command with an oversized payload length, the attacker could cause th...

CVE-2022-32250-LPE

CVE-2022-32250-LPE Exploit LPE per CVE-2022-32250 - una vulnerabilità Use-After-Free in netfilter. Il mio write-up della vulnerabilità: Conquistare un Use-After-Free in nftables: Analisi Dettagliata e Sfruttamento di CVE-2022-32250 Compilazione La compilazione richiede libmnl e libnftnl...

CVE-2026-74689

A flaw was found in the Linux kernel. An ineffective length check in the vccsetsockopt function within the Asynchronous Transfer Mode ATM network protocol implementation can lead to a slab-out-of-bounds read. This occurs when a caller passes a mismatched level, bypassing the length check, or when...

CVE-2026-74688

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. This vulnerability arises when the sctpmakeheartbeatack function caches a destination transport without taking a proper reference. If the associated peer transport is removed while a HEARTBEAT ACK chu...

CVE-2026-74686

A flaw was found in the Linux kernel's rqspinlock component. During deadlock detection, the system may not correctly reset the tail of the waiter queue. This improper handling can cause the system to wait indefinitely for a subsequent waiter that never arrives, leading to an indefinite stall and ...

CVE-2026-74684

A flaw was found in the Linux kernel's net: tap module. A NULL pointer dereference can occur in the tapgetuserxdp function when processing an XDP buffer with a GSO virtio-net header and a zero protocol. This can be triggered by a malicious guest in a virtualized environment, leading to a system...

yc-mk8s-sctphantom-mitigation

SCTPhantom Mitigation for Yandex Managed Kubernetes Applicazione automatica della mitigazione per la vulnerabilità CVE-2026-64564 SCTPhantom nel kernel Linux su tutti i worker node del cluster Yandex Managed Kubernetes. Descrizione della vulnerabilità Identificatore CVE CVE ID: CVE-2026-64564 Lin...

Dirty-Frag-CVE-2026-43284

DirtyFrag CVE-2026-43284 – Bericht zur Lab-Erkennungsübung Klassifikation: Internes Lab – CyberLAB Datum: 24. Mai 2026 Plattform: Elastic Stack v9.4.1 Status: Erkennung bestätigt Inhaltsverzeichnis A – Zusammenfassung der Geschäftsleitung B – Ausführlicher Ergebnisbericht 1. Zielsetzung und...

CVE-2026-74682

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver. This vulnerability involves an out-of-bounds write, where the system attempts to write data beyond the allocated memory buffer. This occurs due to incorrect buffer sizing when processing data from...

CVE-2026-74674

A flaw was found in the Linux kernel's memory management mm subsystem. The zappterange function incorrectly flushes the Translation Lookaside Buffer TLB at an invalid address during page table reclaim. This can cause the system to cache references to empty page tables, potentially leading to syst...

CVE-2026-74672

A flaw was found in the Linux kernel. This vulnerability involves a use-after-free UAF error in the memory management subsystem, specifically during operations related to virtual memory vmalloc and page table dumping ptdump. A race condition can occur when the kernel attempts to free page tables...

CVE-2022-0995

CVE-2022-0995 Exploit für CVE-2022-0995. Nutzt einen Heap-Overflow im watchqueue-Komponent des Linux-Kernels. Eine ähnliche Technik wird in dieser Studie beschrieben: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html. Der Exploit wurde auf Ubuntu 21.10 Kernel...

CVE-2026-74670

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the initial setup of the IPVS estimator, if the network namespace is removed, the estimator may continue operating with uninitialized limits. This can lead to an out-of-bounds write when processing network statistics,...