CVE-2026-89604

A flaw was found in the Linux kernel's efivarfs component. An unprivileged local user can exploit this by repeatedly calling the statfs handler on the efivarfs mount point. This action triggers a flood of calls to the QueryVariableInfo runtime service, which is particularly costly on x86 systems...

CVE-2026-89498

A flaw was found in OrangeFS within the Linux kernel. A local client, by sending a specially crafted readdir downcall with a declared trailersize exceeding the actual supplied bytes, can trigger a double-free vulnerability. This memory corruption issue can lead to a system crash, resulting in a...

CVE-2026-89468

A flaw was found in the Linux kernel's lp8788-charger component. During the removal of the lp8788-charger, a race condition can occur where work can be queued and executed after the associated memory has been freed. This use-after-free vulnerability could lead to system instability or a denial of...

CVE-2026-89472

A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this by performing a concurrent write to a charger's...

CVE-2026-89460

A flaw was found in the Linux kernel. A local user can trigger a kernel panic by running the perf stat command while CPUs are being hotplugged. This occurs because the system fails to properly allocate CPU event structures for newly online CPUs, leading to a null pointer dereference. Successful...

CVE-2026-89706

A flaw was found in the Linux kernel's nfsd component. When an asynchronous async copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made durable, resulting in the silent loss of data that was intend...

CVE-2026-89442

A flaw was found in the Linux kernel. The isstifclosassoc ioctl function in the platform/x86: ISST module contains an improper validation of the socketid. This allows a local attacker to cause an out-of-bounds access or a NULL pointer dereference. This could lead to a system crash, resulting in a...

CVE-2026-80959

A flaw was found in the Linux kernel's device-mapper persistent cache dm-pcache component. A local attacker with administrative privileges CAPSYSADMIN could provide a specially crafted cache device, leading to an out-of-bounds read. This vulnerability allows reading past the intended segment data...

CVE-2026-81013

A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the currentpassword or newpassword fields. This occurs because the validatepasswordinput function attempts to access memory before the allocated...

CVE-2026-89661

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A local administrator with CAPSYSADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlockfilesystem after the NFSD server has shut down. This can lead to memory corruption, potentially...

CVE-2026-23111-POC-noddlenpottato

CVE-2026-23111 — noddlenpottato nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上实现从普通用户到 root 的提权。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab 缓存、生成定制化 exploit、编译并运行。 nftables catchall UAF → 非特权 LPE。在大多数 5.10—6.18 Linux 内核上，普通用户可变为 root。 自动适配目标内核 — 检测结构体偏移、解析符号、查找 ROP gadgets、确定 slab...

CVE-2026-89773

A flaw was found in the drm/amd/display component of the Linux kernel. This vulnerability occurs because the High-bandwidth Digital Content Protection HDCP configuration routine is skipped during a transition state when an invalid dmstreamctx is present. This can lead to the HDCP routine not bein...

CVE-2026-89601

A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the ext2setsize and ext2xattrset2 functions, where inode updates for ISSYNC inodes may be lost. This happens because the syncinodemetadata function only processes inodes that are already marked as dirty, leading ...

CVE-2026-89688

A flaw was found in the Linux kernel's nfsd component. During a seqidop replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue could allow an attacker to potentially cause a denial of...

CVE-2026-89502

A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...

CVE-2026-89519

A flaw was found in the Linux kernel's schedext component. Due to a logical error where a stale flag SCXRQBALKEEP could be consumed, the scheduler might incorrectly keep a task running even after it has been dequeued. This could lead to unexpected task management behavior within the kernel...

CVE-2026-89595

A flaw was found in the Linux kernel's fsnotify subsystem, affecting fanotify and inotify. A race condition can occur during concurrent updates to event marks, where the object mask becomes stale. This can lead to a denial of service or information disclosure, as events such as file modifications...

CVE-2026-80964

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture virmidi driver. This vulnerability allows a local user to trigger an out-of-bounds access by manually binding a device via the sysfs interface with an invalid card index. This can lead to system instability or potential...

CVE-2026-80962

A flaw was found in the Linux kernel's dm-pcache component. A local attacker with administrative privileges CAPSYSADMIN could manipulate on-disk cache metadata to provide invalid geometry fields. This manipulation could lead to an out-of-bounds read and write, potentially causing memory corruptio...

CVE-2026-89564

A flaw was found in the Linux kernel's IP multicast forwarding. When a prefetched socket is destroyed, a subsequent operation to free a network packet skb can attempt to access the already freed socket memory. This use-after-free vulnerability can be triggered by a remote attacker sending special...