CVE-2026-38763

CVE-2026-38763 Unistal Systems Pvt. Ltd. 的 Protegent 360 v2.0.0.4 中存在一个问题，允许本地攻击者在内核中引发拒绝服务。...

CVE-2026-20516

CVE-2026-20516: MiracastService confused deputy en Android TV Investigación y divulgación por Davide Di Matteo @Dingo97. Este es mi primer CVE acreditado. Encontré un servicio Miracast con privilegios de sistema, exportado incorrectamente, mientras investigaba un PEAQ Android TV. Un llamador pued...

CVE-2017-6074-DOS

CVE-2017-6074 - 仅DoS利用 Linux DCCP内核恐慌 此仓库提供了原始CVE-2017-6074漏洞利用（Linux内核DCCP子系统中的释放后使用）的修改版本，专门用于展示拒绝服务（DoS）影响。 经过身份验证的本地用户可以触发内核恐慌 ，导致系统完全不可用。 不尝试也不实现 权限提升。 利用需要本地用户访问权限（例如通过SSH）。 仅用于安全研究、PoC演示和受控测试环境。 参考 CVE-2017-6074 CWE-416: 释放后使用 免责声明 ⚠️ 仅在授权的测试系统上运行此代码。此程序将立即导致内核崩溃。 使用风险自负，本人不对不良使用负责。...

DEBIAN-CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

AZL-102617 CVE-2026-92525 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525 RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[]

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-92525

CVE-2026-92525 is a vulnerability in the Linux kernel RDMA/rxe subsystem. For user-space queue pairs, rxe_post_send() takes the is_user branch and schedules send_task without validating the WQE . When rxe_requester() later calls copy_data(), it indexes wqe->dma.sge[cur_sge] using attacker-cont...

-Detection-and-Mitigation-for-CVE-2022-1679

-Detection-and-Mitigation-for-CVE-2022-1679 描述 ath9k 是一个支持 Atheros 芯片的 Linux 内核驱动程序。在 Linux 内核的 Atheros 无线适配器驱动程序中发现了一个释放后使用缺陷，该缺陷出现在用户通过某些输入消息强制 ath9khtcwaitfortarget 函数失败的方式中。此缺陷允许本地用户使系统崩溃或可能提升其权限。建议如果未使用受影响的 CVE-2022-1679 漏洞版本，则将该模块加入黑名单。 安装 root@kitploit: wget...

EUVD-2026-77920

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory...

CVE-2026-84520

A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27. A local attacker may be able to cause unexpected system termination or corrupt kernel memory...

DEBIAN-CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90995

A NULL pointer dereference in the PAM responder of SSSD (System Security Services Daemon) allows a local attacker with access to the PAM responder socket to trigger a crash. The flaw is triggered when the pam_app_services configuration is enabled and the service item is omitted from a crafted pro...

CVE-2026-90994 Sssd: sssd: denial of service via malformed pam v1 requests

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

EUVD-2026-77588

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

CVE-2026-90994 Sssd: sssd: denial of service via malformed pam v1 requests

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...

EUVD-2026-77592

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service DoS by crashing...

CVE-2026-90994

A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This...