CVE-2026-98194

A flaw was found in the Linux kernel's Libertas TF wireless driver. During device cleanup, the driver releases command memory buffers before stopping the associated timer callback. This timing issue creates a use-after-free condition where an active timer callback accesses released memory, allowi...

CVE-2026-98197

A flaw was found in the Linux kernel's w83791d hardware monitoring driver. This vulnerability allows a local user to cause a Denial of Service DoS by triggering a kernel crash. During driver removal, the driver fails to unregister optional sysfs interface files, leaving them accessible after the...

CVE-2026-98185

A flaw was found in the mwifiex driver in the Linux kernel. When processing wireless scan responses, the driver fails to properly validate response extents before calculating internal buffer boundaries. A malicious or compromised wireless device sending malformed scan response data can trigger an...

CVE-2026-98184

A flaw was found in the Linux kernel's mwifiex driver. An integer truncation vulnerability occurs during authentication frame length calculation, causing the driver to allocate an undersized memory buffer. A local attacker with network administration privileges can exploit this issue by submittin...

cve-2026-31431

CVE-2026-31431 Copy Fail Toolkit This repository contains detectors and a PoC for the Linux algifaead / authencesn page-cache scratch-write vulnerability CVE-2026-31431. Disclosure article: https://xint.io/blog/copy-fail-linux-distributions Authorization Notice Only use this on hosts you own or...

CVE-2026-31431_CopyFail_LinuxKernel_LPE

CVE-2026-31431 — Copy Fail Linux Kernel LPE Educational rewrite of the Theori/Xint proof-of-concept for CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel's algifaead crypto socket interface. Affects every mainline kernel from 4.14 July 2017 through 6.18.21, and the 6....

CVE-2026-31431

CVE-2026-31431 — Copy Fail Local Privilege Escalation in the Linux kernel's authencesn cryptographic template via AFALG + splice. Disclosed April 29, 2026 by Theori Xint Code. Overview Field| Detail ---|--- CVE| CVE-2026-31431 Nickname| Copy Fail CVSS| 7.8 HIGH Type| Local Privilege Escalation LP...

CVE-2026-31431-Check

CVE-2026-31431 Copy Fail Vulnerability Check Script Vulnerability Overview CVE-2026-31431 Copy Fail is a Linux kernel local privilege escalation vulnerability that exploits AFALG sockets address family 38 combined with the splice zero-copy system call to bypass file write permissions and tamper...

block-copyfail

block-copyfail Prova di concetto di mitigazione runtime per CVE-2026-31431 "Copy Fail" — un'escalation di privilegi nel kernel Linux tramite il template crittografico authencesn in algifaead. A differenza del blacklisting dei moduli, questo non richiede riavvio. Un programma BPF LSM aggancia...

copy_fail

Copy Fail — CVE-2026-31431 CVE-2026-31431 Copy Fail is a local privilege escalation vulnerability in the Linux kernel's algifaead module AFALG subsystem. A logic flaw introduced in August 2017 allows any unprivileged local user to write 4 controlled bytes into the page cache of any readable file...

CVE-2026-31431

CVE-2026-31431 "Copy Faill" CVE-2026-31431 Archive and Analysis. Source code for attack Testing Sniffing Tools for the potential Vulnerability. Solution 禁用内核模块 echo "install algifaead /bin/false" /etc/modprobe.d/disable-algif-aead.conf 卸载已加载模块 rmmod algifaead 2/dev/null...

CVE-2026-31431-CopyFail-static-ELF--POC

CVE-2026-31431: Copy Fail - 587-byte static ELF I did not find this bug. Credit goes to Xint Code / Theori. This repo is my take on making the exploit as small as possible - a hand-rolled x8664 ELF that does the full LPE in 587 bytes. No libc, no linker, no runtime. Just NASM and stubbornness. In...

Copy-Fail---CVE-2026-31431

Copy-Fail---CVE-2026-31431 CVE-2026-31431 "Copy Fail" - Analysis and defensive research for the Linux kernel AFALG privilege escalation vulnerability affecting all major distributions since 2017. 100% reliable LPE via authencesn logic flaw Files include a binary , that automates the whole process...

dirty-frag-check

Controllo Dirty Frag CVE-2026-43284 / CVE-2026-43500 Checker in sola lettura per le vulnerabilità local-root "Dirty Frag" del kernel Linux CVE-2026-43284, CVE-2026-43500. Verifica la versione del kernel, lo stato dei moduli, il livepatch KernelCare e qualsiasi blacklist di modprobe che hai...

kernel: ipv6: add NULL checks for idev in SRv6 paths

A flaw was found in the Linux kernel. Missing null pointer checks in the IPv6 Segment Routing SRv6 implementation, specifically within the seg6hmacvalidateskb and ipv6srhrcv functions, can occur when an IPv6 device lacks proper configuration. This oversight may allow an attacker to trigger a null...

kernel: thermal: core: Fix thermal zone device registration error path

A flaw was found in the Linux kernel's thermal core subsystem. When thermalzonedeviceregisterwithtrips fails during device registration, it does not properly wait for the thermal zone device's removal completion. This can lead to the premature freeing of the device's memory, creating a...

kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

A flaw was found in the Linux kernel's tunnels module. This vulnerability, categorized as a Use-After-Free UAF, arises from improper handling of network header pointers during certain packet processing operations. Specifically, functions responsible for building Internet Control Message Protocol...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine for arm64 architectures. An issue in the reallocation of the nestedmmus array allows a process to access freed memory. This memory corruption vulnerability could enable a local attacker to escalate privileges or cause a denia...

kernel: gfs2: add some missing log locking

A flaw was found in the Linux kernel's Global File System 2 GFS2 component. The gfs2logd function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion...