356247 matches found
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...
kernel: tipc: require net admin for TIPCv2 netlink mutators
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...
kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy
A flaw was found in the Linux kernel. A local unprivileged user could exploit this flaw to achieve privilege escalation by modifying read-only files cached in memory. The issue occurs because the networking subsystem fails to preserve shared memory indicators when transferring network data buffer...
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir
A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...
Exploit for CVE-2026-98432
cve-2026-98432-check Read-only shell check for whether a Linu...
kernel: tipc: require net admin for TIPCv2 netlink mutators
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...
kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
A flaw was found in the Linux kernel's afunix UNIX domain sockets component. A race condition in the unixstreamdatawait function allows a local attacker to trigger a Use-After-Free UAF vulnerability. This occurs because the function peeks at a socket buffer without proper locking, enabling anothe...
kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
A flaw was found in the Linux kernel's iSCSI target core. This use-after-free vulnerability occurs in the corescsi3emulateproregisterandmove function. When processing iSCSI TransportIDs, a memory buffer is prematurely unmapped while still being referenced, particularly when the parameter list spa...
kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy
A flaw was found in the Linux kernel. A local unprivileged user could exploit this flaw to achieve privilege escalation by modifying read-only files cached in memory. The issue occurs because the networking subsystem fails to preserve shared memory indicators when transferring network data buffer...
kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir
A flaw was found in the Linux kernel's SMB Server Message Block client subsystem. When a user lists files in a directory on a mounted share, a malicious SMB server can return a crafted directory entry with an oversized filename length. Because the client fails to verify that the filename remains...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.15. It stems from the tracing module failing to hold tracetypeslock when updating persistent instances. Concurrent deletion of instances may result in access to a tracearray that has been freed, leading to use-after-free conditions during...
PT-2026-135522
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Refcount corruption occurs in the tracing synthetic event handling. In the event hist trigger parse and hist unreg all functions, the system uses find synth event to look up events via...
PT-2026-135516
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory corruption issue exists in the io uring/waitid component. The io waitid function uses a 31-bit reference counter within the -refs field, with bit 31 serving as a cancellation...
Linux kernel DoS
The vulnerability in the fs/erofs/zmap.c component of the Linux kernel system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to cause a denial of service...
nvmet module Kernel Unauthenticated Access
The vulnerability in the nvmet module of the Linux kernel is related to the use of uninitialized memory during processing of the Get Log Page parameter. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...
Linux kernel skb_zerocopy Privilege Escalation
The vulnerability in the skbzerocopy function within net/core/skbuff.c on the Linux kernel system is related to memory initialization errors. Exploiting this vulnerability may allow an attacker to escalate their privileges...
ksmbd module Code Execution
The vulnerability in the ksmbd module of the SMB server implementation in Linux kernel is related to an integer overflow. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...
PT-2026-135518
In the Linux kernel, the following vulnerability has been resolved: io uring/wait: don't spin on a stuck overflow list As long as IO CHECK CQ OVERFLOW BIT is set, io cqring wait schedule returns right away, before it gets to look at signals or arms the timeout, for io cqring wait to flush the...
PT-2026-135529
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos commit quota goal for zero target value Patch series "mm/damon: move zero damos quota target value handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...
PT-2026-135520
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.115 Linux kernel versions prior to 6.18.60 Description A use-after-free issue exists in the io uring waitid handling. The io waitid wait function clears the -head variable before establishing ownership of th...