PT-2026-108767

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth set channels tears down XDP resources for removed RX queues without clearing rq-xdp prog. If the program is then detached or replaced, those queues keep the old pointer...

PT-2026-108761

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle incoming queue pulls pull to bytes into the head before calling eth type trans. pull to is the length of the first RX slot, capped at RX COPY THRESHOLD, and that...

PT-2026-108766

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf action delete drops the reference held by its lookup before calling tcf idr delete index with the saved action index. An unlocked classifier can remove that action an...

CVE-2026-98191

A flaw was found in the Linux kernel's wlcore Wi-Fi driver. When configuring a wireless regulatory domain fails, the driver does not release an acquired runtime Power Management PM reference. A local user could exploit this flaw during device configuration failures to cause a reference count leak...

CVE-2021-3493

CVE-2021-3493 Ubuntu OverlayFS 로컬 권한 상승 설명 "overlayfs 파일 시스템에서 우분투 특정 문제로, 리눅스 커널이 사용자 네임스페이스와 관련된 파일 시스템 기능 적용을 제대로 검증하지 않았습니다. 로컬 공격자가 이를 이용해 권한을 상승시킬 수 있으며, 이는 우분투에서 비특권 overlayfs 마운트를 허용하기 위해 적용된 패치 때문입니다." - Ubuntu 보안 Linux 5.11에서 수정됨 영향을 받는 버전 Ubuntu 20.10 Ubuntu 20.04 LTS Ubuntu 19.04 LTS...

DirtyPipe-Exploit

CSE 5380: 情報セキュリティ論文 CVE-2022-0847 Dirty Pipe 著者 Karan Vasudevamurthy UTA ID: 1002164438 CVEとは? Common Vulnerabilities and Exposures CVE...

CVE-2018-18955

CVE-2018-18955 Linux 로컬 루트 익스플로잇. Jann Horn의 익스플로잇에 대한 래퍼로, CVE-2018-18955를 대상으로 하며, kernel-exploits에서 포크되었습니다. Linux 커널 4.15.x부터 4.19.x 4.19.2 이전에서 kernel/usernamespace.c의 mapwrite는 5개 이상의 UID 또는 GID 범위를 가진 중첩된 사용자 네임스페이스를 잘못 처리하여 권한 상승을 허용합니다. 영향을 받는 사용자 네임스페이스에서 CAPSYSADMIN을 가진 사용자는 네임스페이스 외부의...

CVE-2026-98196

A flaw was found in the Linux kernel's brcmsmac wireless driver. When a timer is released, the driver fails to wait for running background tasks associated with the timer to finish before freeing memory. A local attacker could exploit this race condition to trigger a use-after-free condition,...

CVE-2026-98190

A flaw was found in the Linux kernel's wilc1000 wireless driver. The driver fails to adequately validate the length of incoming Wi-Fi Direct P2P public action frames before reading the frame header, leading to an integer underflow and out-of-bounds memory read. A nearby unauthenticated attacker c...

CVE-2026-98195

A flaw was found in the Linux kernel's iwlegacy wireless driver. This flaw allows a local user to cause a Denial of Service DoS by toggling the radio frequency kill RFKILL switch during driver initialization. Improper state tracking in the error-handling path leads to the duplicate deallocation o...

CVE-2026-98187

A flaw was found in the Linux kernel's p54 Wi-Fi driver. The driver fails to verify that an entire interface record fits within the buffer boundaries when parsing EEPROM Electrically Erasable Programmable Read-Only Memory data. An attacker capable of attaching a crafted wireless device or supplyi...

CVE-2026-98189

A flaw was found in the Linux kernel's wilc1000 wireless driver. An attacker utilizing a malicious or compromised SDIO Secure Digital Input Output hardware device can cause a Denial of Service DoS or kernel memory corruption by triggering an out-of-bounds write. This issue occurs because the driv...

CVE-2026-98198

A flaw was found in the Linux kernel's PWM fan driver. A local privileged user can cause a Denial of Service DoS or memory corruption by unbinding or detaching the driver. Due to an improper cleanup sequence, internal data structures are released while the sampling timer is still active, resultin...

CVE-2026-98193

A flaw was found in the Linux kernel's libipw wireless driver. When processing Temporal Key Integrity Protocol TKIP network frames, the driver assumes the frame contains a complete Message Integrity Check MIC without verifying that the packet meets the minimum expected length. An attacker within...

CVE-2026-98199

A flaw was found in the Linux kernel's Power Management Bus PMBus subsystem. This vulnerability allows an attacker capable of triggering the probing of affected power management devices to cause a Denial of Service DoS or memory corruption. The issue stems from certain hardware drivers supporting...

CVE-2026-98192

A flaw was found in the Linux kernel's wcn36xx Wi-Fi driver. This vulnerability can lead to a Denial of Service DoS or system instability due to a use-after-free condition. When deinitializing the transmission acknowledgement timer during device removal, the driver stops the timer without waiting...

CVE-2026-98200

A flaw was found in the Linux kernel's HP WMI Sensors hp-wmi-sensors driver. Due to a missing lock when reading sensor properties, a race condition can occur when sensor data is freed and replaced during an update while another operation is reading it. A local user could exploit this flaw by...

CVE-2026-98194

A flaw was found in the Linux kernel's Libertas TF wireless driver. During device cleanup, the driver releases command memory buffers before stopping the associated timer callback. This timing issue creates a use-after-free condition where an active timer callback accesses released memory, allowi...

CVE-2026-98197

A flaw was found in the Linux kernel's w83791d hardware monitoring driver. This vulnerability allows a local user to cause a Denial of Service DoS by triggering a kernel crash. During driver removal, the driver fails to unregister optional sysfs interface files, leaving them accessible after the...

CVE-2026-98185

A flaw was found in the mwifiex driver in the Linux kernel. When processing wireless scan responses, the driver fails to properly validate response extents before calculating internal buffer boundaries. A malicious or compromised wireless device sending malformed scan response data can trigger an...