335648 matches found
CVE-2026-31431
Autore: 0xShe Lingua / 语言 English: https://github.com/0xShe/CVE-2026-31431/blob/main/README.md 中文: https://github.com/0xShe/CVE-2026-31431/blob/main/README-CN.md Guida allo strumento di escalation dei privilegi del kernel CVE-2026-31431 0x01 Avvio rapido Alcuni ambienti target non hanno Python...
ksmbrace
ksmbrace Ricerca di vulnerabilità in ksmbd , il server SMB3 nel kernel Linux fs/smb/server/. Difetti lato attaccante autenticato sui percorsi durable-handle e di risoluzione dei path di ksmbd. Il nome richiama il tema della race condition di questa linea di lavoro vedi la UAF sul byte-range-lock...
CVE-2026-53365
CVE-2026-53365 — VsockDrop: underflow del reference count zero-copy di iouring + AFVSOCK, escalation di privilegi tramite riscrittura della Page-Cache Mirror di distribuzione HackSpeak. Questo repository è un mirror di distribuzione di MaherAzzouzi/vsockdrop , il codice è identico a quello...
ghostlock-cve-2026-43499
CVE-2026-43499 GhostLock — ARM32 Kernel Privilege Escalation Research Linux kernel futex PI rtmutex Use-After-Free vulnerability research and exploit development targeting Huawei Watch 4 Pro MDS-AL00 , Snapdragon SW5100, armv7l, kernel 5.4.210. Vulnerability removewaiter in kernel/locking/rtmutex...
CVE-2026-46300_Fragnesia
🧨 Fragnesia — CVE-2026-46300 Linux Kernel LPE Audit & Exploit Toolkit · Page-Cache / XFRM ESP-in-TCP espintcp Regression Interaktives Audit → Erkennung der LPE-Voraussetzungen → Automatische Exploit-Ausführung nach Bestätigung ⚠️ Ethische & rechtliche Warnung Dieses Tool ist ausschließlich für...
januscape
Januscape — Sito di tracciamento dell'escape guest-to-host di Linux KVM/x86 Sorgente del tracker dello stato delle patch Januscape : un sito a pagina singola che registra quali distribuzioni hanno pubblicato una correzione per l'escape guest-to-host KVM/x86 nel kernel Linux. Dove vivono i fatti...
ipv6_frag_escape
IPV6FRAGESCAPE — Sito di monitoraggio della fuga dai container tramite frammentazione IPv6 in Linux Sorgente del tracker dello stato delle patch IPV6FRAGESCAPE : un sito a pagina singola che registra quali distribuzioni hanno rilasciato una correzione per la fuga dai container tramite...
kernel: igc: set tx buffer type for SMD frames
A flaw was found in the Linux kernel's igc network driver. The igcfpeinitsmdframe function, responsible for initializing transmit TX buffer fields for Stream-based Data SMD frames, does not correctly set the buffer type. This can result in stale XDP eXpress Data Path or XSK AFXDP socket types...
kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker
A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...
kernel: vsock/virtio: bind uarg before filling zerocopy skb
A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
A flaw was found in the Linux kernel's Intel Ethernet controller driver idpf. This vulnerability occurs because a critical synchronization mechanism, known as a spinlock, is accessed before it has been properly initialized. An attacker could potentially exploit this timing issue to cause the syst...
kernel: vsock/vmci: fix UAF when peer resets connection during handshake
A flaw was found in the vsock/vmci component of the Linux kernel. A remote attacker could exploit a Use-After-Free UAF vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being le...
kernel: nfsd: initialize copy-notify stateid before publishing it
A flaw was found in the nfsd component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted OFFLOADCANCEL operation, leading to a race condition that...
kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF
A flaw was found in the nfsd component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash...
kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup
A flaw was found in the Linux kernel's Network File System Daemon NFSD. The nfsd4decodesecinfononame function does not properly initialize a pointer sinexp before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from...
kernel: nfsd: revoke copy-notify stateids before dropping their reference
A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...
kernel: nfsd: revoke copy-notify stateids before dropping their reference
A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...
kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker
A flaw was found in the Linux kernel's SUN Remote Procedure Call SUNRPC implementation. A use-after-free vulnerability exists in the Transport Layer Security TLS connection path. When a TLS handshake fails, the client resource can be prematurely freed, leading to a subsequent attempt to access th...
kernel: vsock/virtio: fix zerocopy completion for multi-skb sends
A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers skbs. An issue in how user arguments uargs are handled for these buffers can lead to pinned user pages not being...
kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup
A flaw was found in the Linux kernel's Network File System Daemon NFSD. The nfsd4decodesecinfononame function does not properly initialize a pointer sinexp before processing an incoming data stream. If the data stream is malformed or truncated, the uninitialized pointer can retain stale data from...