CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation

CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilegieneskalation Dieses Repository enthält einen Proof of Concept PoC für CVE-2025-6019, eine Race-Condition-Schwachstelle in udisks2, die eine lokale Privilegieneskalation über die Vergrößerung von XFS-Dateisystemen ermöglicht. 🎯 Zielumgebungen &...

CVE-2025-6018-and-CVE-2025-6019

Prüfen ob verwundbar oder nicht root@kitploit: rpm -q pam || dpkg -l | grep libpam or find /etc/pam.d/ -name '' -exec grep -l 'pamenv' \; 2/dev/null or find /etc/pam.d/ -name '' -exec grep -l 'pamsystemd' \; 2/dev/null or systemctl --version | head -1 Wenn Version enthalten ist:Verwundbare...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Escalation Locale dei Privilegi LPE - openSUSE / SUSE Linux Enterprise 15 PoC/Exploit funzionante per CVE-2025-6018 e CVE-2025-6019 - Escalation dei privilegi da utente non privilegiato a root su openSUSE Leap 15.x e SUSE Linux Enterprise 15.x 🎯 Riepilogo...

CVE-2025-6019

CVE-2025-6019 PoC Semplice proof-of-concept per un'escalation dei privilegi nel ridimensionamento XFS di UDisks2. File createpayload.sh: Crea un'immagine XFS con un payload SUID rootbash. exploit.sh: Innesca il percorso di ridimensionamento e avvia la shell SUID. Requisiti mkfs.xfs, udisksctl,...

ThisSeemsWrong

Fix for this issue appeared as CVE-2024-49746: bulletin, patch "Questo sembra sbagliato" Il titolo sopra è il commento dal metodo Parcel::continueWrite, che in realtà è responsabile del ridimensionamento degli oggetti Parcel, sia quando esplicitamente richiesto dall'utente ad esempio tramite...

CVE-2025-6019-exploit

CVE-2025-6019: Privilege-Eskalations-Exploit über UDisks2-Dateisystemvergrößerung Details zur Schwachstelle CVE-ID : CVE-2025-6019 Auswirkung : Lokale Privilegienausweitung LPE Betroffene Systeme : Linux-Systeme mit anfälligen udisks2-Versionen Mechanismus : Race-Condition während der...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098793)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098793 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix null deref on srq-rq.queue after resize failure A NULL pointer dereference can occu...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: Avoid failures during online resizing due to an overly large flexbgsize. When we perform online resizing on an ext4 filesystem with an excessively large flexbgsize, the following warning is triggered:...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s MagickCore/resize.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, including division by zero in mathematics. The highest threat from this vulnerability is to system availability...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: md/bitmap: fixed the GPF issue in writepage caused by the resize race. A General Protection Fault occurs in writepage during array resizing: RIP: 0010:writepage+0x22b/0x3c0 mdmod This is a use-after-free race between...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: tty: Fixed out-of-bound access to vmalloc in imageblit. This issue occurs when a user-space program calls ioctl FBIOPUTVSCREENINFO, passing the fbvarscreeninfo structure containing only the fields xres, yres, and bitsperpixel wit...

CVE-2026-74634

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634

This vulnerability affects the Linux kernel ring-buffer subsystem. The root cause is that ring_buffer_subbuf_order_set() frees buffer pages even when resizing is disabled, leaving a non-consuming reader exposed to a use-after-free in rb_advance_iter(). The fix returns -EBUSY on resize_disabled, m...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

EUVD-2026-64571

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

CVE-2026-74634 ring-buffer: Prevent subbuf order change when resizing is disabled

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceite...

Linux Distros Unpatched Vulnerability : CVE-2026-74634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ring-buffer: Prevent subbuf order change when resizing is disabled Because ringbuffersubbuforderset frees buffer pages, we can't allow it when resizing is...

CVE-2026-70652 libvips: Possible heap-based buffer read overflow when resizing and re-encoding a JPEG with gain map

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...

CVE-2026-74261

A flaw was found in the ALSA Advanced Linux Sound Architecture sequencer component of the Linux kernel. A local attacker could exploit a race condition during the FIFO First-In, First-Out resize operation. This vulnerability allows stale data cells to persist, preventing the proper deallocation o...

Linux Distros Unpatched Vulnerability : CVE-2026-72032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5: HWS, fix matcher leak on resize target setup failure hwsbwcmatchermove allocates a replacement matcher before setting it as the resize target. If...