linux-kernel-exploits

linux-kernel-exploits Introduction linux-kernel-exploits Vulnerability List CVE Description Kernels CVE–2018–18955 mapwrite in kernel/usernamespace.c allows privilege escalation Linux kernel 4.15.x through 4.19.x before 4.19.2 CVE–2018–1000001 glibc glibc 2.6.22 released in 2007 CVE-2016-2384 a...

CVE-2026-46331

🚨 CVE-2026-46331 - Linux Kernel COW Bug Linux Kernel net/sched Partial Copy-on-Write COW Page Cache Corruption -orange?style=for-the-badge A Linux kernel vulnerability caused by incorrect Copy-on-Write COW handling in the traffic control tc packet editing subsystem. 📖 Overview CVE-2026-46331 is a...

ROOT-OS-UBUNTU-2204-CVE-2026-64405 CVE-2026-64405 in linux - Patched by Root

Root has patched CVE-2026-64405 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-9002-1 linux-nvidia-tegra vulnerabilities

It was discovered that the iouring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could possibly use this to cause a denial of service system...

USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities

It was discovered that the iouring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could possibly use this to cause a denial of service system...

K000164139: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-53016 In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AFALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccpaescomplete restores AESBLOCKSIZE bytes into the caller's IV buffer...

My-CVEs

A list of vulnerabilities I found. Some vulnerabilities come with deep technical writeups, exploits or even fuzzing session walkthroughs. Some vulnerabilities don't have CVEs because maintainers ghosted me, or because a maintainer didn't agree it's a security bug, I decided to release those as...

CVE-2026-46333

🚀 CVE-2026-46333 - ssh-keysign-pwn High-quality Proof of Concept for the Linux kernel race condition vulnerability A clean and reliable proof-of-concept exploit for CVE-2026-46333 — Local information disclosure via race condition in the Linux kernel's process exit path. 🖼️ Screenshot Successfully...

CVE-2026-89960

A flaw was found in the Linux kernel's s390/vfio-ap component. This vulnerability occurs when an error during the setup of a virtual machine KVM leaves a pointer to a cryptographic function in an invalid state. A malicious guest virtual machine could exploit this by executing a specific...

CVE-2026-89957

A flaw was found in the Linux kernel's s390/vfio-ap component. When an AP adapter or domain is hot-unplugged from a KVM Kernel-based Virtual Machine guest, the system may fail to update the guest's configuration. This occurs because a function responsible for updating the guest's configuration...

CVE-2026-89774

A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented SCO module. This Use-After-Free UAF vulnerability occurs due to a race condition where the system attempts to use a memory region after it has been freed. A remote attacker could exploit this flaw by initiating a...

CVE-2026-80886

A flaw was found in the Linux kernel's msm serial driver. A race condition can occur during concurrent writes from userspace and the kernel to the console Universal Asynchronous Receiver/Transmitter UART. This happens when userspace initiates a Direct Memory Access DMA transfer while the kernel's...

CVE-2026-80881

A flaw was found in the OCFS2 component of the Linux kernel. This vulnerability stems from improper management of buffer heads within the ocfs2readblocks function. It can result in a buffer head being reused with outdated information, even after previous validation failures. This allows...

CVE-2026-80874

A flaw was found in the Linux kernel. This vulnerability occurs when the system experiences high memory usage, potentially leading the kernel to improperly access and corrupt memory regions designated for the DBSC5 DRAM controller's inline Error-Correcting Code ECC operations. This unauthorized...

CVE-2026-80871

A flaw was found in the Linux kernel's Xilinx True Random Number Generator TRNG driver. This vulnerability is caused by the xtrngtrnggenerate function sometimes failing to completely fill the requested random bytes and a race condition between xtrngtrnggenerate and xtrnghwrngtrngread due to...

CVE-2026-80867

A flaw was found in the Linux kernel's Alpha/PCI subsystem. A local user could exploit a missing security check in the pcimmapresource function, which allows mapping of PCI Base Address Registers BARs to userspace. This vulnerability could enable a local attacker to perform Direct Memory Access D...

CVE-2026-98959

A flaw was found in the Linux kernel's Btrfs file system. A local user can cause a Denial of Service DoS and file system corruption by replacing an extended attribute xattr with a value of a different size on files where multiple attributes share the same directory item. Because the kernel fails ...

CVE-2026-89999

A flaw was found in the Linux kernel's Human Interface Device HID Wacom driver. A malicious or malfunctioning Bluetooth peripheral could send an undersized report to the wacomintuospro2btirq function. The driver fails to validate the report length before parsing, leading to an out-of-bounds read...