EUVD-2026-86798

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

CVE-2026-97944

The Linux kernel contains a flaw in the x86/cfi implementation where the cfi_get_func_hash() function uses an incorrect hard-coded offset for the FineIBT hash. This mismatch occurred because the hash immediate moved from offset 7 to offset 5 during a preamble optimization. Consequently, the BPF J...

CVE-2026-97942

The Linux kernel contains a vulnerability in the x86 alternatives patching code where a race condition between text poking and change_page_attr (CPA) can occur. If vmalloc_to_page() fails due to this race, it can result in the collapsing of page tables or the breaking of PMD hugepages . This issu...

EUVD-2026-86797

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

EUVD-2026-86796

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

CVE-2026-97943

The Linux kernel contains a vulnerability in the x86 architecture's Change Page Attributes (CPA) mechanism. Specifically, the cpa_collapse_large_pages() function can collapse kernel page table entries into huge page table entries and free the old page tables without holding necessary locks. This ...

CVE-2026-97941

A race condition exists in the Linux kernel memory management system within mm/slab. The __slab_try_return_freelist() function incorrectly assumed that no objects were freed to a slab if slab->freelist was NULL and cmpxchg succeeded. This oversight leads to a classic ABA problem where a slab c...

EUVD-2026-86795

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

CVE-2026-97941 mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

Kali-Setup

Kali 自定义脚本 此脚本创意最初来自 g0tmi1k https://github.com/g0tmi1k/os-scripts。我不声称对脚本的基础部分拥有功劳！ 话虽如此，我添加了大量的工具，并修复了原版中的许多错误。我会维护它，并按照我的喜好保持更新。 用 Python 重写为 kali.py。现在运行和维护都非常简单。 请根据个人喜好编辑脚本中开头的几个变量 运行：python3 ./kali.py 由 Raikia 编辑 Kali 截图...

CVE-2026-97939

The Linux kernel is affected by a vulnerability where a netadmin in a user+net namespace could create numerous IPv4 and IPv6 multicast routing tables using MRT_TABLE and MRT6_TABLE. Because these mr_table objects were not charged to memcg , the host's unreclaimable slab would grow proportionally ...

EUVD-2026-86794

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

EUVD-2026-86793

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97940

The Linux kernel is affected by a Use-After-Free (UAF) vulnerability in the ipv6 component. The issue arises because ipv6_route_iter_active() incorrectly treats a walker in FWS_U at the table root as already unlinked. This allows fib6_del_route() to move a still-linked walker into that state when...

CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

CVE-2026-97938

The Linux kernel contains a use-after-free race condition involving the cad_pid struct pid pointer. The issue occurs because proc_do_cad_pid() reads the pointer and passes it to pid_vnr() without protecting its lifetime; a concurrent writer can replace the pointer and drop the reference before th...

EUVD-2026-86791

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

CVE-2026-97937 ftrace: fork: Initialize function graph state before copy_exec_state()

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

CVE-2026-97937

The Linux kernel contains a vulnerability in ftrace where the child function graph state is not initialized early enough during a fork operation. Specifically, dup_task_struct() copies the parent's task_struct including the ret_stack. Because ftrace_graph_init_task() currently runs after copy_exe...

EUVD-2026-86792

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...