CVE-2022-22029-NFS-Server-

Windows Network File System Remote Code Execution Vulnerability CVE-2022-22039 To successfully exploit this vulnerability, an attacker must succeed in a race condition. Making an unauthenticated, carefully constructed call to a Network File System NFS service could be used to exploit this...

CVE-2022-26937

CVE-2022-26937 A package to detect CVE-2022-26937, a vulnerability in Microsoft's NFS implementation. Example You can run this logic on the included PCAP in the testing\traces directory: $ zeek -Cr CVE-2022-26937-exploited.pcap /Source/CVE-2022-26937/scripts/load.zeek $ cat notice.log separator...

CVE-2022-30136

CVE-2022-30136 Windows Network File System Remote exploit PoC author: Ricardo Narvaja For demonstration purposes only. Complete exploit works on vulnerable Windows Server systems. Checkout the writeup Analysis of CVE-2022-30136 “Windows Network File System Vulnerability“. Usage Analysis of...

Enigm-Writeup

Hack The Box: Enigma - Comprehensive Penetration Testing & Write-Up Report 1. Executive Summary Enigma is an intermediate-level Linux machine hosted on Hack The Box. The assessment methodology follows a standard penetration testing lifecycle: reconnaissance, enumeration, initial access via...

cve-2026-43687

CVE-2026-43687 — Reverse engineering notes and reproduction Independent reverse engineering of the macOS NFS client access-cache race CVE-2026-43687, plus a working PoC that triggers the race and captures it live with dtrace. The bug is an unsynchronized read of the nfsnode access-cache pointer i...

NfSpy

NfSpy - an ID-spoofing NFS client by Daniel Miller NfSpy is a Python library for automating the falsification of NFS credentials when mounting an NFS share. Included are two client programs: nfspy uses the Filesystem in Userspace FUSE library to mount an NFS share in Linux. This allows the use of...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

CVE-2026-89098

A flaw was found in nfs-utils. The fsidd daemon improperly handles inp...

CLSA-2026-1791800936 kernel: Fix of 191 CVEs

drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check CVE-2026-89818 - drm/amdgpu/vcn4: Avoid overflow on msg bound check CVE-2026-46199 - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg CVE-2026-46199 - drm/amdgpu/vcn3: Avoid overflow on msg bound check CVE-2026-46230 -...

CLSA-2025-1747430081 Fix of 47 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47352 - virtio-net: Add validation for used length CVE-url: https://ubuntu.com/security/CVE-2024-46745 - Input: uinput - reject requests with unreasonable number of slots CVE-url: https://ubuntu.com/security/CVE-2024-44952 - driver core: Fix ueventsho...

CLSA-2025-1764151168 kernel: Fix of 40 CVEs

perf/aux: Fix AUX buffer serialization CVE-2024-46713 - block: fix uaf for flush rq while iterating tags CVE-2024-53170 - zram: fix potential UAF of zram table CVE-2025-21671 - sched: schcake: add bounds checks to host bulk flow fairness counts CVE-2025-21647 - bpf: Fix UAF via mismatching...

SUSE CVE-2026-89098

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an...

CLSA-2025-1762171389 kernel: Fix of 16 CVEs

nfs: fix possible null-ptr-deref when parsing param CVE-2022-50455 - KVM: arm64: Disassociate vcpus from redistributor region on teardown CVE-2024-40989 - HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 - ALSA: usb-audio: Validate UAC3 cluster segment descriptors...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46124)

In the Linux kernel, the following vulnerability has been resolved: isofs: validate block number from NFS file handle in isofsexportiget isofsfhtodentry and isofsfhtoparent pass an attacker- controlled block number ifid-block or ifid-parentblock from the NFS file handle to isofsexportiget, which...

CLSA-2026-1775655705 kernel-uek: Fix of 34 CVEs

ALSA: usb-audio: Fix use-after-free in sndusbmixerfree CVE-2026-23089 - HID: core: Harden s32ton against conversion to 0 bits CVE-2025-38556 - KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory CVE-2024-50115 - KVM: x86: Reset IRTE to host control if new route isn't postable CVE-2025-37885...

CLSA-2026-1769610819 kernel: Fix of 42 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

CLSA-2026-1768669128 kernel: Fix of 42 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

CLSA-2025-1764085382 kernel-uek: Fix of 236 CVEs

drm/amd/display: Skip on writeback when it's not applicable CVE-2024-36914 - ASoC: topology: Fix references to freed memory CVE-2024-41069 - Bluetooth: RFCOMM: Fix not validating setsockopt user input CVE-2024-35966 - Bluetooth: SCO: Fix not validating setsockopt user input - drm/dpmst: Fix MST...

CLSA-2026-1771077729 kernel: Fix of 108 CVEs

net/ieee802154: don't warn zero-sized rawsendmsg CVE-2022-50706 - bpf: Don't redirect packets with invalid pktlen CVE-2022-49975 - media: uvcvideo: Fix 1-byte out-of-bounds read in uvcparseformat CVE-2025-38680 - ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network...

EUVD-2026-103204

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory...