CVE-2021-3929-3947

CVE-2021-3929-3947 VM escape PoC for CVE-2021-3929 and CVE-2021-3947. Educational purposes only. You can read the white paper for more information. Environment OS: Ubuntu 21.10 Linux: 5.13.0 gcc: 11.2.0 glibc: 2.34 glib: 2.68.4 QEMU: 6.1.0 Guest OS: Ubuntu 21.04 Commands Host qemu-system-x8664 ru...

CVE-2023-5178

CVE-2023-5178 The exploit for CVE-2023-5178: NVMe-oF-TCP vulnerability, which is a logic error in NVMe-oF-TCP driver during the handle of corrupted Initialize Connection Request. It leads to racy double-free in kmalloc-96 , which can be exploited to gain LPEsee demo below. The exploit targets...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bondsetupbyslave CVE-2026-43456 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped CVE-2026-72434 In the Linux...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: nvme: add missing SRCU grace period in error path

A flaw was found in the NVMe Non-Volatile Memory Express driver of the Linux kernel. The nvmeallocns function's error handling path fails to wait for all SRCU Sleepable Read-Copy Update readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

A flaw was found in the Linux kernel's NVMe over Fabrics NVMe-oF target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service DoS through a system crash or potential...

kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...

kernel: nvme-pci: fix dma_vecs leak on p2p memory

A flaw was found in the Linux kernel's nvme-pci driver. This vulnerability occurs due to improper handling of peer-to-peer P2P memory, where dmavec allocations are not correctly unmapped. This oversight leads to a memory leak, which can degrade system performance and potentially lead to a denial ...

USN-9018-1 linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file systems library; - Stream parser; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture;...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-151323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151323 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvmetcphandler2t does not check th...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme: Zero out the discard fallback page nvmesetupdiscard always maps sizeofstruct nvmedsmrange NVMEDSMMAXRANGES = 4096 bytes as the DSM payload, regardless of how many ranges the command specifies; some devices ignore the ‘Numbe...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel,...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Use acquire/release for queue enabled state applenvmeinitqueue initializes the queue state and then marks the queue as enabled. The interrupt and request paths check whether the queue is enabled before using that stat...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, resulting in double...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvmeaddctrl fails nvmfcreatectrl owns the fabrics options and frees them whenever -createctrl returns an error; therefore, a transport must not free them on its own error paths...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path The error path in nvmeallocns at outunlinkns removes ns from the namespace head siblings list using listdelrcu&ns-siblings, but does not wait for SRCU readers before freeing the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix flex array size in struct nvmenshead struct nvmenshead contains a flexible array member, currentpath, which is indexed using the NUMA node ID: head-currentpathnumanodeid The structure is currently allocated as...