CVE-2026-74678

A flaw was found in the Linux kernel's ax88179178a USB network driver. When the network interface has scatter-gather SG enabled and a packet linearization operation fails, the system fails to free the associated memory buffer. This oversight leads to a memory leak, which could be exploited by an...

CVE-2026-74676

A flaw was found in the Linux kernel. A missing permission check in the KDSKBMETA ioctl input/output control allows a local process to modify the keyboard meta mode on a non-controlling console without proper authorization. This could enable an attacker to make unauthorized changes to system...

CVE-2026-74653

A flaw was found in the Linux kernel's 8250of serial driver, specifically affecting NXP LPC32xx UARTs. A local user could repeatedly open a specific serial port, triggering a stuck RX character-timeout interrupt. This leads to an interrupt storm that can livelock the CPU, resulting in a Denial of...

CVE-2026-74633

A flaw was found in the Linux kernel's tracing module. A local user can trigger a NULL pointer dereference by attempting to remove a specific event filter for an unloaded module. This vulnerability arises when a module-only event filter is cached with a null match, and a subsequent write operatio...

CVE-2026-74622

A flaw was found in the Linux kernel's 'atlantic' network driver. The aqringrxdeinit function, responsible for deinitializing receive RX buffers, fails to properly free pages and their associated Direct Memory Access DMA mappings for buffers that have been consumed but not yet refilled. This...

CVE-2026-74708

A flaw was found in the Linux kernel's xsk AFXDP socket component. This vulnerability arises from improper validation of launch-time metadata size, where the metadata can extend beyond its allocated structure. This could lead to inconsistent decisions if user space concurrently changes flags,...

CVE-2026-74601

A flaw was found in the Linux kernel's ring-buffer component. A race condition exists within the ringbufferswapcpu function, where a committing counter can temporarily drop to zero during a write operation. This allows a buffer swap to occur while a write is still in progress, resulting in an...

CVE-2026-74718

A flaw was found in the devlink component of the Linux kernel. When the devlinknlreloaddoit function is called, it may fail to release a network namespace reference under specific error conditions. This oversight occurs when the requested network namespace differs from the current one and the...

CVE-2026-74698

A flaw was found in the Linux kernel's net/mlx5e driver. When a Send Queue SQ is re-activated, the Byte Queue Limits BQL counters are incorrectly reset even if there are still network transmissions in progress. This can lead to an inconsistent state, causing the kernel to trigger an error and...

CVE-2026-74699

A flaw was found in the drm/xe component of the Linux kernel. This vulnerability occurs due to improper handling of the q-replaystate, where it is blindly overwritten. This can lead to a memory leak of previously allocated resources. An attacker could exploit this flaw to exhaust system memory,...

CVE-2026-74680

A flaw was found in the Linux kernel's cxacru USB ATM driver. When the cxacrucm function encounters an error, it fails to properly terminate an already submitted receive USB Request Block URB. This oversight can lead to the driver attempting to resubmit an active URB, which triggers a warning in...

CVE-2026-74654

A flaw was found in the Linux kernel's 8250dma serial driver. When a serial port is closed while an RX receive transfer is active, a stale state can persist where the rxrunning flag remains set even though the receive channel is no longer available. If the port is subsequently reopened, a specifi...

Dirty-Frag-CVE-2026-43284

Dirty-Frag-CVE-2026-43284 Dirty Frag CVE‑2026‑43284 & CVE‑2026‑43500 — Laboratorio di Riproduzione e Rilevamento dell'Exploit Questo repository documenta la riproduzione end‑to‑end, l'ingegneria del rilevamento e la risposta agli incidenti per la catena di escalation dei privilegi locali LPE Dirt...

Copy-Fail-CVE-2026-31431-Lab

Copy Fail CVE-2026-31431 — Laboratório de Reprodução e Detecção de Exploit Este repositório documenta a reprodução de ponta a ponta, a engenharia de detecção e a resposta a incidentes para CVE-2026-31431 "Copy Fail" , uma vulnerabilidade crítica de escalonamento de privilégios local no kernel Lin...

rootpacket-cve-2026-31431

rootpacket CVE-2026-31431 Un toolkit di cryptojacking Linux da Docker all'host catturato da attacchi live su Kinryū Labs honeypot. Entra attraverso un'API del motore Docker esposta, evade dal container per ottenere root sull'host con CVE-2026-31431 , installa un rootkit del kernel ed esegue un...

CVE-2024-1086-Exploit

🔒 Projeto de Exploit CVE-2024-1086 🛡️ Exploit educacional polido do kernel Linux para pesquisa em segurança Este projeto fornece um modelo robusto e não funcional para estudar CVE-2024-1086, uma vulnerabilidade de use-after-free no componente netfilter: nftables do kernel Linux, possibilitando...

CVE-2022-0847-Exploit-Implementation

CVE-2022-0847-Exploit-Implementation Questo è un POC che mostra come ottenere una shell bash inversa per l'esecuzione arbitraria di codice su una macchina esterna utilizzando CVE-2022-0847, "Dirty Pipe Exploit". Questa vulnerabilità colpisce solo le versioni del kernel Linux 5.8 o successive, ma ...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Prova di concetto — uid=1000raken → uid=0root dopo ./sley su WSL2 6.6.87.2-microsoft-standard-WSL2 Prova di concetto in un singolo file per CVE-2026-43494 PinTheft: un'escalation dei privilegi locali del kernel Linux che combina un bug di conteggio dei riferimen...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-Concept zur lokalen Privilegienausweitung mittels XFRM/ESP-Seitencache-Korruption 4-Byte-Schreibprimitive · 48 Iterationen · 192-Byte-ELF-Überschreibung · unprivilegierter Benutzer + netns Proof of Concept Links: Kernel-Preflight, setuid-Scan und...

CVE-2026-23111-nftables-lab

CVE-2026-23111 nftables LPE: एक्सपोज़र जाँच और सुरक्षित लैब CVE-2026-23111 के लिए रक्षात्मक टूलिंग और एक पुनरुत्पादनीय वर्चुअल-मशीन लैब, लिनक्स कर्नेल में nftables यूज़-आफ्टर-फ्री लोकल प्रिविलेज एस्केलेशन एक उलटा एलिमेंट-एक्टिविटी चेक nftmapcatchallactivate में, "off by !" बग। एक अनप्रिविलेज्ड लो...