CVE-2023-6931

CVE-2023-6931 Kernel Panic PoC for CVE-2023-6931 Description CVE-2023-6931 is a vulnerability in perfevent that leads to a heap buffer overflow caused by an integer overflow in the readsize of a group. What is a Performance Event perf event? perfevents is a performance monitoring and analysis...

CVE-2026-90366

A flaw was found in the Linux kernel's mt76 Wi-Fi driver, specifically affecting mt7996 devices. When a Channel Switch Announcement CSA countdown is active and Multiple Basic Service Set Identifier MBSSID is enabled, the driver may attempt to write more beacon data than allocated. This can lead t...

CVE-2024-27804

CVE-2024-27804 ./build.sh ./panic.sh paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3: 0xfffffe3a396e3444 x4: 0xfffffe3a396e344...

poc-dsa-verify-CVE-2019-17596

Exploiting dsa.Verify in Go CVE-2019-17596 Please see the associated blog post for details. Running Since versions of Go newer than 1.13.1 are patched, I;ve included a Dockerfile, that makes it easier to pin your Go version. Simply run Docker build: docker build . There are two files of interest:...

cve-2026-23398-poc

Lab: CVE-2026-23398 ICMP / ipnopmtudisc=3 Reproducible lab for the Linux kernel bug in icmptagvalidation NULL dereference when net.ipv4.ipnopmtudisc = 3 and a Fragmentation Needed ICMP arrives whose quoted inner IPv4 header uses a protocol number with no handler in inetprotos. Authorized use only...

CVE-2019-14079

USB device fuzzing on Android CVE-2019-14079 This blog post is about a simple bug I found in my android deviceMI A2 - runs stock android using USB device fuzzing and was marked as high severity by google. The bug was in Qualcomm USB driver which was later patched and disclosed in March 2020 Andro...

CVE-2025-29338

CVE-2025-29338 — Security Advisory Buffer Overflow in NXP moal.ko Wi-Fi Kernel Driver woalsetupmoduleparam / parsecfggetline Field| Value ---|--- CVE ID| CVE-2025-29338 Severity| High CVSS v3.1 Score| 7.8 CVSS v3.1 Vector| CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability Type| Stack-Bas...

CVE-2017-2671

Linux kernel CVE-2017-2671 Local Denial of Service Vulnerability what !! CVE-2017-2671 1 Linux kernel CVE-2017-2671 Local Denial of Service consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service panic by leveraging access to the...

CVE-2022-25636

CVE-2022-25636 This is my exploit for CVE-2022-25636. I tested it against Ubuntu 21.10 with kernel 5.13.0-30. Works about 40% of the time, in the other cases you likely get a kernel panic. The exploit might corrupt important data on heap, after an unsuccessful attempt it's best to reboot...

GO-2026-6689 Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize

Panic and memory exhaustion via unbounded CFB stream allocation in github.com/xuri/excelize...

CVE-2026-93321

A flaw was found in BuildKit. A malicious build frontend can submit a crafted low-level builder LLB definition that triggers an unexpected panic in the BuildKit daemon. This issue leads to a Denial of Service DoS, causing the daemon process to crash and interrupting all active builds running on t...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

CVE-2019-8852

CVE-2019-8852 A tfp0 bug for macOS 10.15.1 and below. Warranty Use it on your own risk. This will make you macOS panic. I build it for security researchers only. Current state Just a PoC, convert the vulnerability to a useful UAF. Tested on macOS 10.14.6 18G103 , MacBook Pro with 16 GB RAM. Credi...

kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when commands sent to the firmware FW are not properly cleared after a chip reset. A local attacker could exploit a race condition during direct memory access DMA unmapping, leading to a kernel panic. This can...

Panic lowering a host-created component model stream into a guest that expects a different payload type

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-9pvw-hwfg-92h5 For more information see the GitHub-hosted security advisory...

Centry

Centry WARNING: THIS IS EXPERIMENTAL SOFTWARE. IT IS LIKELY TO CONTAIN BUGS. Updates If you have already installed Centry, please run git pull to update to the latest version. The latest updates make it much more secure against replay attacks. Introduction Centry is a panic button intended to...

mt6985-CVE-2026-43499

CVE-2026-43499 Failure Log: MT6985 Adaptation Attempt Conclusion : Spent 68M tokens, no root obtained. Reason : KernelSnitch timing attack is unreliable on MTK Dimensity 9200, and CONFIGPANICONOOPS=y leaves no room for trial and error. This article documents the complete troubleshooting process f...

CVE-2025-39866

CVE-2025-39866 - use-after-free Author: Byte Reaper Description This POC attempts to exploit the CVE-2025-39866 vulnerability, which is a flaw in Linux systems iwb” and schedules the critical free via “wbputmany”. step 3 : - thread 2 : free wbolb - thread 1 - pointer - free object wb free old -...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist-dos The sysctlcoalitiongetpidlist function in bsd/kern/syscoalition.c uses the coalitiongetpidlist function to collect a list of PIDs in a coalition. This function will return the number of PIDs if successful or a negative errno on failure. However, the...

CVE-2020-9283

Exploit for CVE-2020-9283 This project is inspired by the original POC found here github.com/mark-adams/exploits/CVE-2020-9283. I was curious as to how the Go SSH library was implemented so decided to implement the PoC using go. A short writeup can be found here...