CVE-2026-89981

A flaw was found in the Linux kernel, specifically affecting arm64 architectures. When the Memory Tagging Extension MTE is disabled, the kernel attempts to read a register GMIDEL1 that should not be accessed. In a virtualized environment utilizing protected Kernel-based Virtual Machine pKVM, this...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

MAccConc

Overview This is tooling for exploring Linux kernel race conditions and for general kernel debugging. See also the announcement blog post https://projectzero.google/2026/09/maccconc-race-condition.html. There are currently three tools: 1. A GUI for viewing KCOV traces of Linux kernel execution an...

CVE-2017-8890

CVE-2017-8890 Related documents: ubuntu kernel dual-machine debugging method CVE-2017-8890 Vulnerability Analysis and Exploitation - Overview CVE-2017-8890 Vulnerability Analysis - Principles CVE-2017-8890 Vulnerability Exploitation root ubuntu 16.04@kernel 4.10 CVE-2017-8890 Vulnerability...

CVE-2026-89992

A flaw was found in the Linux kernel. The dtidlepdfree function in the cpuidle subsystem attempts to free a memory region using an incorrect pointer, which is not the start of the original allocation. This memory corruption vulnerability can lead to a system crash, resulting in a Denial of Servic...

CVE-2026-89849

A flaw was found in the Linux kernel's qla2xxx SCSI driver. When the firmware delivers an unexpected status input/output control block IOCB for a non-SCSI command, the driver can incorrectly process a garbage pointer. This wild pointer dereference can lead to system instability or a denial of...

CVE-2026-90029

A flaw was found in the Linux kernel's realtekcr USB storage driver. This vulnerability, a use-after-free, occurs when the system attempts to access memory that has already been released. During a USB device disconnection, a timer within the realtekcr module is deleted before its associated...

CVE-2026-89962

A flaw was found in the Linux kernel's powerpc/kexecfile component. The mergememoryranges function incorrectly handles overlapping memory ranges, leading to critical memory truncation. This issue can cause valid memory areas to be lost from kexec exclude lists, potentially allowing the crash kern...

CVE-2026-90038

A flaw was found in the Network File System Daemon NFSD component of the Linux kernel. This vulnerability, a use-after-free, occurs when the nfsd4revokeexportstates function improperly handles client state revocation. An administrator removing an export can trigger a race condition, potentially...

CVE-2026-81000

⚡ CVE-2026-81000 - TUNderflow Linux Kernel TUN/TAP Receive Headroom Memory Corruption A Linux kernel memory-corruption vulnerability in the TUN/TAP networking subsystem , caused by insufficient bounds on receive headroom and an integer underflow in the packet allocation path. ⚠️ Disclaimer This...

CVE-2026-89988

A flaw was found in the kprobes component of the Linux kernel. A local attacker could potentially exploit a use-after-free vulnerability when a module is unloaded concurrently with a call to withinkprobeblacklist. This could lead to dereferencing freed memory, potentially causing system instabili...

CVE-2022-23222-POC

Proof of Concept Exploit Code for CVE-2022-23222 This is a POC for CVE 2022-23222, a Local Privilege Escalation vulnerability. This POC was written for Ubuntu 20.04 with kernel version 5.13.0-27-generic, but other kernel versions are also vulnerable. For a detailed analysis of the exploit, please...

CVE-2026-89805

A flaw was found in the drm/pagemap component of the Linux kernel. This vulnerability involves a 'use-after-free' error, a type of memory corruption, that occurs when the system attempts to access memory after it has been released. This could allow a local attacker to cause the system to crash,...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

CVE-2026-89821

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability occurs when the islutlinear function processes a Look-Up Table LUT with a single entry, triggering a division-by-zero error. This error causes the kernel to crash, leading to a Denial of Service DoS for the syste...

CVE-2026-90042

A flaw was found in the Ceph filesystem client within the Linux kernel. This vulnerability arises from the improper handling of memory buffers during filename decryption, specifically when buffers are allocated in the vmalloc region. This can lead to a kernel panic, causing the system to crash. A...

CVE-2026-89991

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. When a Non-Maskable Interrupt NMI re-enters the pcpufreelistpush function on a system configured with a single possible CPU, and the interrupted context holds the freelist lock, an infinite loop can occur. This prevents...

CVE-2026-89842

A flaw was found in the Linux kernel's qla2xxx SCSI driver. Under certain conditions, specifically when the firmware is not fully initialized or is in a reset state, the driver attempts to communicate with it. This can cause the system to try and process an invalid command, leading to instability...

CVE-2026-89942

A flaw was found in the Linux kernel's Industrial I/O IIO buffer subsystem. An anonymous buffer handle, which maintains a reference to an IIO device, can be improperly released if it holds the last reference when the device is removed. This improper handling of a mutex during the buffer's release...

CVE-2026-89893

A flaw was found in the Linux kernel's cx23885 NetUP CI driver. This use-after-free vulnerability occurs when the netupciexit function frees a netupcistate structure while a related work item may still be pending or running. A local attacker could exploit this by triggering the module's removal,...