CVE-2026-80756 selinux: do not cancel a policy conversion that never started

This Linux kernel vulnerability affects the SELinux subsystem. When the first policy load fails during selinuxfs tree construction, sel_write_load() calls selinux_policy_cancel(), which dereferences a NULL state->policy pointer (no outgoing policy exists on the initial load). The bug is trigge...

CVE-2021-24086-exp

CVE-2021-24086 这是针对 CVE-2021-24086（"Windows TCP/IP 拒绝服务漏洞"）的概念验证，该漏洞是 tcpip.sys 中的空指针解引用，由微软于 2021 年 2 月修补。根据这条 推文，该漏洞由 @piazzt 发现。可通过发送恶意的 IPv6 UDP 数据包远程触发。 你可以在此处阅读微软的博客：影响 TCP/IP 的多个安全更新：CVE-2021-24074、CVE-2021-24094 和 CVE-2021-24086。它简要讨论了影响以及解决方法/缓解措施。 关于根本原因的更深入讨论可在 doar-e.github.io 上找到：逆向工...

CVE-2025-4476-Exploit

CVE-2025-4476-Exploit 一个用于发送带有超大 Authorization: Basic 头的 HTTP GET 请求的小型 Python 测试客户端。 该工具旨在用于实验室测试和研究头部解析问题（例如，libsoup 中诸如 CVE-2025-4476 的空指针解引用/崩溃漏洞）。它演示了带有畸形头的客户端-服务器交互如何触发解析错误；它不是一个漏洞利用框架。 用法：仅针对本地或已授权的测试目标运行。 重要提示：请负责任地使用——未经明确许可，请勿扫描或攻击系统。...

cve-2026-23398-poc

实验：CVE-2026-23398（ICMP / ipnopmtudisc=3） 针对 Linux 内核 icmptagvalidation 中漏洞的可复现实验（当 net.ipv4.ipnopmtudisc = 3 且收到一条 Fragmentation Needed ICMP 报文，其引用的内部 IPv4 头使用在inetprotos 中无处理程序的协议号时，会发生 NULL 指针解引用）。 仅限授权使用： 仅限您拥有或已获得明确书面许可进行测试的系统。影响为拒绝服务 （内核崩溃）。 主机要求 组件| 用途 ---|--- QEMU...

pipewire: RAOP RTSP NULL Deref

RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return...

Moderate: Red Hat Security Advisory: pipewire security update

An update for pipewire is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Linux Distros Unpatched Vulnerability : CVE-2026-80648

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per- pin descriptor with spacemitgetpin then checks the wrong...

RockyLinux 9 : pipewire (RLSA-2026:61240)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61240 advisory. pipewire: RAOP RTSP NULL Deref CVE-2026-14324 pipewire: Pulse Server alloca Stack Overflow CVE-2026-14330 Tenable has extracted the preceding descriptio...

Linux Distros Unpatched Vulnerability : CVE-2026-80664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtnat: reject unsupported target families xtnat SNAT and DNAT target handlers assume IP- family conntrack state is present and can dereference a NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-80621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS D...

Drishti: AI-Led Human-Directed Vulnerability Auditing for 5G Cores

Candidate generation for open-source vulnerabilities is no longer scarce. AI-assisted code review now produces defect candidates cheaply, and industry programs pair them with expert human triage. The remaining scarcity is validation and impact assessment, and the gap is largest in...

CVE-2025-68325

CVE-2025-68325 schcake non considera il caso in cui cakeenqueue restituisce un risultato non nullo, portando a uno squilibrio del qlen nell'albero qdisc e innescando un null-deref nel suo scheduler padre, ad esempio qfq. Versioni interessate Corretto in v6.19-rc1 Gravità Bassa Patch root@kitploit...

SUSE CVE-2026-80636

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

AZL-98057 CVE-2026-80684 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...

CVE-2026-80664

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtnat: reject unsupported target families xtnat SNAT and DNAT target handlers assume IP-family conntrack state is present and can dereference a NULL pointer when instantiated from an unsupported family through nftcompa...

CVE-2026-80648

In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemitpinsetconfig spacemitpinsetconfig looks up the per-pin descriptor with spacemitgetpin then checks the wrong variable for failure: const struct spacemitpin spin = spacemitgetpinpctrl,...

CVE-2026-80646

In the Linux kernel, the following vulnerability has been resolved: ipv6: guard against possible NULL deref in in6devstatsget devgetbyindexrcu could return NULL if the original physical device is unregistered. Found by Sashiko...

CVE-2026-80621

In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: Avoid dwcpcierasdesdebugfsdeinit NULL dereference when no RAS DES capability dwcpcierasdesdebugfsinit returns success when the controller has no RAS DES capability, leaving pci-debugfs-rasdesinfo unset. The common debug...

UBUNTU-CVE-2026-80684

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure The airqivcreate can return NULL on failure, but the return value was never checked. If it fails, zdev-aibv will be NULL and fail when dereferenced in kvmzpcisetairq...