CVE-2023-3338-DECPwn

DECPwn 使用我的DECnet漏洞和空页映射启用，练习不同的Linux内核利用技术。 场景 全部禁用 ：qemu-system-x8664 -append "nosmap nosmep nopti nokaslr" 代码执行被重定向到用户态的output函数，该函数调用commitcredspreparekernelcred0。 系统调用挂钩 将 syscalltable 中的 mkdir 系统调用处理程序地址替换为一个类似于场景1的函数。 启用SMEP和KPTI ：qemu-system-x8664 -append "nosmap nokaslr"...

CVE-2023-2598

CVE-2023-2598 什么是 iouring？ iouring 是 Linux 的系统调用接口。到目前为止，它几乎支持所有系统调用，而不仅仅是最初的 read 和 write。它使应用程序能够发起可异步执行的系统调用。 提交队列与完成队列 在每个 iouring 实现的核心都有两个环形缓冲区 —— 提交队列（SQ）和完成队列（CQ）。这些环形缓冲区在应用程序和内核之间共享。 我们可以通过 iouringgetsqe 获取一个描述你想要由内核执行的 syscall 的提交队列项（SQE）。应用程序随后执行 iouringenter 系统调用，以有效地告诉内核提交队列中有待处理的工作。...

SPOILER

SPOILER: los peligros de la carga especulativa potencian los ataques Rowhammer y de caché CVE-2019-0162 INTEL-SA-00238 https://www.usenix.org/system/files/sec19-islam.pdf root@kitploit: @inproceedings 236252, author = Saad Islam and Ahmad Moghimi and Ida Bruhns and Moritz Krebbel and Berk...

Astra Linux – Vulnerability in Linux 5.10

A flaw was discovered in the pfnswapentrytopage function within the memory management subsystem of the Linux kernel. In this flaw, an attacker with local user privileges may cause a denial-of-service attack due to a BUG statement that references pmdt x...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: riscv: Rewrite kernelmappages to prevent sleeping in an invalid context. kernelmappages is a debugging function that clears the “valid bit” in page table entries for deallocated pages, thereby detecting illegal memory accesses to...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: Avoid corrupting the page-mapping in hugetlbmcopyatomicpte. In the MCOPYATOMICCONTINUE case with a non-shared VMA, the pages in the page cache are stored in the ptes. However, hugepageaddnewanonrmap is called for thes...

CVE-2026-68240

A flaw was found in the Linux kernel's drm/gpusvm component. When drmgpusvmgetpages encounters an error during page mapping, it fails to properly unmap previously created device mappings. This oversight can lead to a device mapping leak, consuming system resources and potentially impacting system...

EUVD-2026-55341

In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: publish dpagemap early to avoid device mapping leak on error drmgpusvmgetpages only stored the local dpagemap into svmpages-dpagemap on the success path. If a later page failed e.g. -EOPNOTSUPP when ctx-allowmixed is...

K000162723: Linux kernel vulnerability CVE-2026-53199

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN. Entries for the RNDIS header and the sk...

CVE-2026-64300

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 shadow paging mechanism. This vulnerability occurs when a host page directory entry PDE mapping is changed from within the guest, leading to an unexpected role mismatch in shadow paging. This mismatch can cause a...

SUSE CVE-2026-64130

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix initialization of tags of the huge zero folio with initonfree GFPZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside GFPZERO and GFPSKIPKASAN. If we run with...

CVE-2026-64181 mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()

In the Linux kernel, the following vulnerability has been resolved: mm: fix vmnormalpage to handle missing support for pmdspecial/pudspecial On x86 32-bit with THP enabled, zaphugepmd is seen to generate a "WARNING: mm/memory.c:735 at vmnormalpage+0x6a/0x7d", from the VMWARNONONCEiszeropfnpfn ||...

EUVD-2026-45815

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: fix initialization of tags of the huge zero folio with initonfree GFPZEROTAGS semantics are currently a bit weird, but effectively this flag is only ever set alongside GFPZERO and GFPSKIPKASAN. If we run with...

CVE-2026-34196: Use After Free

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtual addresses to the same physical address. One of these virutal mappings can be freed along with the physical page, allowing for a read/write UAF via the...

Linux Distros Unpatched Vulnerability : CVE-2026-53199

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN...

CVE-2026-53199

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN. Entries for the RNDIS header and the skb linear data come from...

CVE-2026-53199

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN. Entries for the RNDIS header and the skb linear data come from...

CVE-2026-53199 hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: use kmaplocalpage in netvsccopytosendbuf netvsccopytosendbuf copies page buffer entries into the VMBus send buffer using phystovirt on the entry PFN. Entries for the RNDIS header and the skb linear data come from...

CVE-2026-53199

CVE-2026-53199 pertains to the Linux kernel hv_netvsc path, where netvsc_copy_to_send_buf previously used phys_to_virt() on page buffer PFNs and could fault when fragments referenced high mem/user pages on 32-bit x86 with HIGHMEM. The fix maps pages with kmap_local_page() and reconstructs native ...