PT-2026-108762

In the Linux kernel, the following vulnerability has been resolved: bpf: Use array map meta equal for percpu array inner map replacement percpu array map ops.map meta equal points to the generic bpf map meta equal, which does not compare max entries. When a percpu array serves as an inner map,...

PT-2026-108765

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t rpfilter: reject routes without inet6 dev ip6 route lookup can return an error-free route whose rt6i idev is NULL. Lowering an external nexthop device's MTU below IPV6 MIN MTU tears down its inet6 dev while fib6...

PT-2026-108766

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf action delete drops the reference held by its lookup before calling tcf idr delete index with the saved action index. An unlocked classifier can remove that action an...

PT-2026-108767

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth set channels tears down XDP resources for removed RX queues without clearing rq-xdp prog. If the program is then detached or replaced, those queues keep the old pointer...

PT-2026-108768

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpf offload dev match falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal...

PT-2026-108770

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of sk protocol in bpf sock destroy sk protocol lives in struct sock, not in struct sock common. A timewait or request sock handed to bpf sock destroy by the tcp iterator is neither, so reading sk-sk...

PT-2026-108763

In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in vlan insert inner tag vlan insert inner tag only guarantees head room via skb cow head, never that mac len bytes of MAC header are present. Its ETH HLEN wrappers - vlan insert tag und...

PT-2026-108769

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf skb pull data for LWT SEG6LOCAL An LWT SEG6LOCAL program can invalidate its cached SRH with bpf lwt seg6 adjust srh and then call bpf skb pull data. The latter may reallocate skb-head, leaving the per-CPU SRH...

CVE-2026-98191

A flaw was found in the Linux kernel's wlcore Wi-Fi driver. When configuring a wireless regulatory domain fails, the driver does not release an acquired runtime Power Management PM reference. A local user could exploit this flaw during device configuration failures to cause a reference count leak...

CVE-2021-3493

CVE-2021-3493 Ubuntu OverlayFS 本地权限提升 描述 "Ubuntu 特有的问题，存在于 Linux 内核的 overlayfs 文件系统中，它未能正确验证文件系统能力在用户命名空间中的应用。本地攻击者可以利用此漏洞获取更高权限，原因是 Ubuntu 携带了一个允许非特权 overlayfs 挂载的补丁。" - Ubuntu 安全公告 已在 Linux 5.11 中修复 受影响版本 Ubuntu 20.10 Ubuntu 20.04 LTS Ubuntu 19.04 LTS Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu...

DirtyPipe-Exploit

CSE 5380：信息安全论文 CVE-2022-0847（脏管道） 作者 Karan Vasudevamurthy UTA ID: 1002164438 什么是 CVE？ 通用漏洞与暴露（CVE）是一个公开披露的信息安全漏洞和暴露的列表。MITRE 公司于 1999 年引入 CVE，用于识别和分类软件和固件中的漏洞。MITRE 是一家非营利组织，在美国运营由联邦资助的研究与开发中心。CVE 旨在促进关于已知漏洞的信息共享，以便网络安全计划能够更新以反映最新的安全问题和弱点。为此，CVE 为每个漏洞或暴露分配一个唯一标识符。这些标识符也称为 CVE 名称或 CVE...

CVE-2018-18955

CVE-2018-18955 Linux 本地 root 提权漏洞利用。 针对 Jann Horn 的 exploit 为 CVE-2018-18955 编写的封装程序，fork 自 kernel-exploits。 在 Linux 内核 4.15.x 至 4.19.x（4.19.2 之前）中，kernel/usernamespace.c 中的 mapwrite 因错误处理包含超过 5 个 UID 或 GID 范围的嵌套用户命名空间而允许权限提升。在受影响的用户命名空间中拥有 CAPSYSADMIN 的用户可以绕过该命名空间外部资源的访问控制，如读取 /etc/shadow 所示。这是因...

CVE-2026-98196

A flaw was found in the Linux kernel's brcmsmac wireless driver. When a timer is released, the driver fails to wait for running background tasks associated with the timer to finish before freeing memory. A local attacker could exploit this race condition to trigger a use-after-free condition,...

CVE-2026-98190

A flaw was found in the Linux kernel's wilc1000 wireless driver. The driver fails to adequately validate the length of incoming Wi-Fi Direct P2P public action frames before reading the frame header, leading to an integer underflow and out-of-bounds memory read. A nearby unauthenticated attacker c...

CVE-2026-98195

A flaw was found in the Linux kernel's iwlegacy wireless driver. This flaw allows a local user to cause a Denial of Service DoS by toggling the radio frequency kill RFKILL switch during driver initialization. Improper state tracking in the error-handling path leads to the duplicate deallocation o...

CVE-2026-98187

A flaw was found in the Linux kernel's p54 Wi-Fi driver. The driver fails to verify that an entire interface record fits within the buffer boundaries when parsing EEPROM Electrically Erasable Programmable Read-Only Memory data. An attacker capable of attaching a crafted wireless device or supplyi...

CVE-2026-98189

A flaw was found in the Linux kernel's wilc1000 wireless driver. An attacker utilizing a malicious or compromised SDIO Secure Digital Input Output hardware device can cause a Denial of Service DoS or kernel memory corruption by triggering an out-of-bounds write. This issue occurs because the driv...

CVE-2026-98198

A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service DoS or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resultin...

CVE-2026-98193

A flaw was found in the Linux kernel's libipw wireless driver. When processing Temporal Key Integrity Protocol TKIP network frames, the driver assumes the frame contains a complete Message Integrity Check MIC without verifying that the packet meets the minimum expected length. An attacker within...

CVE-2026-98199

A flaw was found in the Linux kernel's Power Management Bus PMBus subsystem. This vulnerability allows an attacker capable of triggering the probing of affected power management devices to cause a Denial of Service DoS or memory corruption. The issue stems from certain hardware drivers supporting...