kernel: thermal: core: Fix thermal zone device registration error path

A flaw was found in the Linux kernel's thermal core subsystem. When thermalzonedeviceregisterwithtrips fails during device registration, it does not properly wait for the thermal zone device's removal completion. This can lead to the premature freeing of the device's memory, creating a...

kernel: openvswitch: fix GSO userspace truncation underflow

A flaw was found in the Open vSwitch component of the Linux kernel. This vulnerability arises from an underflow condition when handling Generic Segmentation Offload GSO packets in userspace. A length calculation error can lead to a buffer underflow when data is processed by the skbzerocopy...

kernel: macsec: fix replay protection at XPN lower-PN wrap

A flaw was found in the Linux kernel's MACsec Media Access Control Security subsystem. When using Extended Packet Numbering XPN, a vulnerability exists where the replay protection mechanism can be bypassed. An attacker can exploit an integer overflow when the packet number reaches its maximum...

kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation

A flaw was found in the Linux kernel. This vulnerability involves an incomplete defense against Spectre-v2, a type of attack that can expose sensitive information by exploiting how modern processors predict future operations. Specifically, when the Berkeley Packet Filter BPF Just-In-Time JIT...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

kernel: af_unix: Unlink scc_entry in unix_del_edge()

A flaw was found in the Linux kernel's afunix component. A race condition during concurrent send and close operations can lead to the garbage collector GC partially freeing a Strongly Connected Component SCC. This inconsistent state may cause subsequent GC operations to iterate over a partially...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

dirtyclone-CVE-2026-43503

CVE-2026-43503 — DirtyClone Linux local privilege escalation. A cloned skbuff loses the SKBFLSHAREDFRAG flag, so ESP in-place decryption writes into file-backed page-cache memory. The PoC patches /etc/passwd in cache to inject a uid-0 account and gives a root shell. Disk is never modified. Fixed ...

dirtyfrag-arm64

dirtyfrag-arm64 arm64/aarch64 port of V4bel/dirtyfrag CVE-2026-43284, CVE-2026-43500. Tested on Ubuntu 24.04.4 LTS with linux-aws 6.17.0-1013-aws on AWS Graviton newest available as of this writing. Full writeup with AppArmor bypass analysis, hardening notes, and detection notes:...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership()

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

COMP3320-VAPT

COMP3320-VAPT Files required to demonstrate CVE-2022-0847 vulnerability in Linux Kernel v5.8 Compilation $ make...

CVE-2023-0386

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalat...

syscall_exploit_CVE-2018-8897

This repository does not have a README...

CVE-2016-5195

demo1 This demo is based on https://github.com/timwr/CVE-2016-5195 make test output: user@user:/$ cd /home/user/demo1 && make test /home/user/adb/android-ndk-r21d/ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPABI=x8664 APPPLATFORM=android-23 make1: Entering directory '/home/user/demo1...

ksmbd-n-day

README This repo accompanies my research article Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130. I provide the kernel .config, a kernel run script, an image build script, and the POC. The...