CVE-2021-3929-3947

CVE-2021-3929-3947 CVE-2021-3929 और CVE-2021-3947 के लिए VM एस्केप PoC। केवल शैक्षिक उद्देश्यों के लिए। आप अधिक जानकारी के लिए श्वेत पत्र पढ़ सकते हैं। पर्यावरण root@kitploit: OS: Ubuntu 21.10 Linux: 5.13.0 gcc: 11.2.0 glibc: 2.34 glib: 2.68.4 QEMU: 6.1.0 Guest OS: Ubuntu 21.04 कमांड्स होस्ट...

CVE-2023-5178

CVE-2023-5178 أداة استغلال CVE-2023-5178: ثغرة NVMe-oF-TCP، وهذه الثغرة عبارة عن خطأ منطقي في مشغّل NVMe-oF-TCP أثناء معالجة طلب Initialize Connection Request التالف. يؤدي ذلك إلى double-free ناتج عن حالة سباق في kmalloc-96 ، والذي يمكن استغلاله للحصول على LPE انظر العرض التوضيحي أدناه. تستهدف أد...

CVE-2026-80862

This Linux kernel vulnerability affects the nvme-tcp subsystem. The page_frag_cache is used to preallocate PDU buffers for preallocated block device requests, but since block devices are created in parallel threads, the cache is accessed in a thread-unsafe manner. This leads to incorrect refcount...

EUVD-2026-71312

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

CVE-2026-80862

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of pagefragcache nvme uses pagefragcache to preallocate PDU for each preallocated request of block device. Block devices are created in parallel threads, consequently pagefragcache is used in not thread-safe...

EUVD-2026-71246

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: fix iovec leak when the async cmd is not recycled An ioasynccmd carries an iovec array in -vec.iovec, allocated when the vec has to grow and kept across recycling through ctx-cmdcache. On two paths nothing frees it a...

EUVD-2026-71434

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTHRECEIVE response buffer nvmetexecuteauthreceive allocates the response buffer with kmalloc sized by the host-supplied AUTHRECEIVE allocation length, but the DH-HMAC-CHAP builders write only a fixed-size...

CVE-2026-80791

CVE-2026-80791 affects the Linux kernel's NVM Express Target (nvmet) authentication module. In nvmet_execute_auth_receive(), the DH-HMAC-CHAP response buffer is allocated with kmalloc() sized by a host-supplied allocation length , but the DH-HMAC-CHAP builders write only a fixed-size message into...

CVE-2026-80789

In the Linux kernel nvmet-tcp component (NVMe/TCP target), a host-controlled 32-bit sgl->length field is only validated for in-capsule SGL descriptors. Non-inline transport SGL data-block descriptors—those used for out-of-capsule writes—skip the check entirely, causing an unbounded sgl_alloc()...

CVE-2026-80788

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations When fuzzing the nvme target code, I tripped a kernel warning in nvmettcpmapdata because the length passed into the allocator is controlled by the remote...

CVE-2026-80787

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-free in nvmetpciepfexeciodwork nvmetpciepfexeciodwork submits an I/O command with req-execute and then waits for the command to complete and transfers the data back to the host. This wait is not need...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

The vulnerabilities of the functions nvmet_tcp_build_pdu_iovec() and nvmet_tcp_handle_req_failure() in the Linux kernel’s drivers/nvme/target/tcp.c module allow attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerabilities of the functions nvmettcpbuildpduiovec and nvmettcphandlereqfailure in the driver/nvme/target/tcp.c module of the Linux kernel are related to error handling flaws. Exploiting these vulnerabilities allows a remote attacker to compromise the confidentiality, integrity, and...

The vulnerability of the nvmet_ctrl_free() function in the drivers/nvme/target/core.c module of the NVME kernel of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the nvmetctrlfree function in the drivers/nvme/target/core.c module of the NVME driver for the Linux operating system is related to the occurrence of mutual locking. Exploiting this vulnerability could allow a remote attacker to cause service failure...

kernel: nvmet-auth: reject short AUTH_RECEIVE buffers

A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

CVE-2026-80620

In the Linux kernel, the following vulnerability has been resolved: Revert "PCI/MSI: Unmap MSI-X region on error" This reverts commit 1a8d4c6ecb4c81261bcdf13556abd4a958eca202. Commit 1a8d4c6ecb4c "PCI/MSI: Unmap MSI-X region on error" added an iounmapdev-msixbase on the error path of...

EUVD-2026-66504

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...

RLSA-2026:59821 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode CVE-2026-63886 kernel: netfilter: conntrack: tcp:...

CVE-2026-80589

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...