CVE-2020-8958

CVE-2020-8958 CVE-2020-8958 : Authenticated Remote Code Execution Exploit for NetLink Routers using boa server. CVSS Score: 7.2 Vulnerability Types: OS Command Injection Authentication: Required Affected Models: HG323 Description The /boaform/admin/formPing resource in Netlink routers allows remo...

kernel: Fix of 42 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

CVE-2026-64531

🔥 CVE-2026-64531 — OVSwrap Linux Kernel Open vSwitch Memory Corruption 🩸 Vulnerability Overview CVE-2026-64531 is a security vulnerability affecting the Linux Kernel Open vSwitch OVS networking subsystem. The flaw exists in the handling of Netlink nested attributes , where oversized action...

CVE-2026-98541

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98584

The Linux kernel contains a potential stack information leak within the net/sched component. The em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. Because strscpy() was used instead of strncpy(), the remaining bytes of the structure remain uninitialized. These ...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98541

The Linux kernel contains a vulnerability where omitting the FOU_ATTR_IPPROTO attribute when sending a FOU_CMD_ADD request with FOU_ENCAP_DIRECT causes fou_create() to initialize the protocol to 0. Because fou_udp_recv() returns 0 when the protocol is 0, it informs the UDP tunnel layer that the s...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

EUVD-2026-103576

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98531

A vulnerability exists in the Linux kernel where the seg6_genl_policy allows a short SEG6_ATTR_DST attribute because it uses NLA_BINARY with a maximum length check. This allows a 16-byte out-of-bounds read past skb->tail into uninitialized memory during a SEG6_CMD_SET_TUNSRC operation. The lea...

CVE-2026-98531 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2017-11176

CVE-2017-11176 Proof of concept for CVE-2017-11176 for code execution. Vulnerability The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial...

CVE-2023-1829

CVE-2023-1829 The exploitation is tested on Ubuntu22.04 official source code 5.15.0-25.25 Installing dependences for some netlink filter functions sudo apt install libnftnl-dev libmnl-dev Building step: make References https://github.com/randorisec/CVE-2022-34918-LPE-PoC/tree/main...

cve-2017-11176

cve-2017-11176 Public Information The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service use-after-free or possibly have...

CVE-2026-96515

CVE-2026-96515: authenticated root command execution in Netlink HG323RW An authenticated limited web user can upload a shell script through the Netlink HG323RW diagnostic import handler and have the UID-0 BOA process execute it. Authentication and valid verification/CSRF values are required; this...

CVE-2022-1015

My POC for CVE-2022-1015 Compile: gcc -o exploit exploit.c helpers.c -lmnl -lnftnl -lpthread -no-pie...

CVE-2026-90113

A flaw was found in the netdevsim component of the Linux kernel. When a network queue is reset, the system fails to correctly update the association with its NAPI New API structure. This can allow a local attacker, by performing a queue reset and then initiating a queue dump via Netlink, to trigg...

mtechweek_04

mtechweek04 Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC CVE-2004-2687, privilege escalation via udev netlink CVE-2009-1185, and vsftpd 2.3.4 backdoor analysis CVE-2011-2523, with firewall mitigation validated end-to-end. This repository...

CVE-2017-7184

CVE-2017-7184 – Linux Kernel XFRM Privilege Escalation No Sudo Overview This repository contains a proof-of-concept local privilege escalation exploit for CVE-2017-7184 , a Linux kernel vulnerability in the XFRM IPsec netlink subsystem. The exploit demonstrates how an unprivileged user can gain...