1319 matches found
CVE-2026-43494
🛠️ PinTheft — CVE-2026-43494 Local Privilege Escalation in Linux Kernel via RDS + iouring Page Cache Overwrite 📌 Overview PinTheft is a sophisticated local root exploit for CVE-2026-43494 , a reference-counting bug in the Linux kernel's Reliable Datagram Sockets RDS subsystem. By combining a...
CVE-2026-43494-PinTheft-PoC
SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...
CVE-2023-20938
CVE-2023-20938 Vulnerability Analysis 1. Client A and Client B establish a Binder connection via the ServiceManager context manager. 2. A creates node 0xbeef node = bindernewnodeproc, fp;. B references node 0xbeef via ref-targetnode. 3. B correctly processes targetnode 0xbeef, enqueuing the...
CVE-2026-98983 unshare: don't drop active namespace references that were never taken
In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces and copynamespaces and dropped...
CVE-2026-98459
A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS due to improper reference counting when handling Broadcast Isochronous Stream BIS connections. During unlinking operations, the kernel may prematurely release an active paren...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: Fixed a UAF Use-after-Allocation issue in tegraslinkremove. After calling spiunregistermaster, the refcount of the master will be decreased to 0, and it will be freed in spicontrollerrelease. The device data...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between the async notify and socket close operations. The thread that submitted the request the one that called recvmsg/sendmsg may exit as soon as the async crypto handler’s call completes. Any cod...
Astra Linux – vulnerability in linux-6.1, linux-5.15
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is a race condition between smb2 session log off and smb2 session setup. This causes user-after-free from session log off. This add sessionlock when setting SMB2SESSIONEXPIRED...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: net/smc: fixed a kernel panic caused by a race condition involving smcsock. A crash occurs when smccdctxhandler attempts to access smcsock, but smcrelease has already freed it. 4570.695099 BUG: Unable to handle a page fault for...
Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fixed potential use after free in efcnportvportdel The krefput function will call nport-release if the reference count drops to zero. The nport-release function is efcnportfree, which frees the “nport” object...
Astra Linux – vulnerability in linux-5.15
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siwqpdestroy call; thu...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: cachefiles: All requests are flushed after setting CACHEFILESDEAD. In ondemand mode, when the daemon is processing an open request, if the kernel marks the cache as CACHEFILESDEAD, the cachefilesdaemonwrite function will always...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: smb: Client side – fixed a potential deadlock that could occur when releasing mids. All callers of releasemid seem to hold a reference to @mid; therefore, there is no need to call krefput&mid-refcount, releasemid under...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The powersupply framework is not actually designed to have long-term references to powersupply devices in the kernel. Specifically, unregistering a...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: s390/zcrypt: fixed reference counting on zcrypt card objects Tests with hot-plugging crypto cards on KVM guests with a debug kernel build revealed an use-after-free of the load field of the struct zcryptcard. The issue was due...
Astra Linux – Vulnerability in poppler, poppler-22
Poppler is a PDF rendering library. Versions before 25.06.0 use std::atomicint for reference counting. Since std::atomicint is only 32 bits in size, it is possible for the reference count to overflow, leading to a use-after-free. Version 25.06.0 addresses this issue...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: - For the media module, in mtk-mdp: Error handling in the probe function has been fixed. - Added mtkmdpunregisterm2mdevice in the error handling path to prevent resource leaks. - Added a check on the return value of...