CVE-2026-41651

🚨 CVE-2026-41651 — Pack2TheRoot Privilege Escalation Vulnerability in PackageKit TOCTOU Race Condition 📌 Overview CVE-2026-41651 is a local privilege escalation vulnerability affecting the PackageKit system service used in various Linux distributions. The vulnerability is caused by a Time-of-Chec...

SNEK_Equinox

SNEK Equinox I would like to thank Nightmare-Eclipse for the inspiration not personal from the project UnDefend - https://web.archive.org/web/20260521145157/https://github.com/Nightmare-Eclipse/UnDefend: Now funnily enough, I found a way to lie to the EDR web console to show that defender is up a...

CVE-2026-41651

Pack2TheRoot — CVE-2026-41651 TOCTOU race in PackageKit's transaction handler. Any local unprivileged user can install arbitrary packages as root with no authentication. Overview Field| Value ---|--- CVE| CVE-2026-41651 Component| PackageKit daemon packagekitd Affected versions| 1.0.2 – 1.3.4 Fix...

VQ-RefluxCore

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Framework VQ-RefluxCore is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation LPE mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities...

POC-CopyEscape-CVE-2026-17106

CopyEscape — PoC for CVE-2026-17106 Educational Proof of Concept of CopyEscape CVE-2026-17106, a TOCTOU race condition vulnerability in docker cp that allows a malicious container to write arbitrary files on the Docker host. Inspired by the original work of masasron , who discovered and documente...

CVE-2024-30088-

Weakness: CWE-367: 검사-시점 사용-시점TOCTOU 경쟁 조건 CVSS 출처: Microsoft CVSS: 3.1 7.0 / 6.3...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713

A TOCTOU race condition in the Linux kernel's NFS Daemon (NFSD) component allows a remote, unauthenticated attacker to bypass append-only file protections. In nfsd_setattr(), the NFSD_MAY_TRUNC permission check samples the file size without holding inode_lock(), but the actual size update is appl...

EUVD-2026-76625

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-89713 NFSD: check truncate permission under inode lock

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC CVE-2026-17106 published by the Imperva Red Team Ron Masas , with the code identical to upstream; upstream does not include a...

sudo_digest_toctou_poc_CVE-2015-8239

sudoers DigestSpec TOCTOU POC Обоснование Alyssa Milburn https://twitter.com/noopwafel обнаружила ошибку состояния гонки TOCTOU в sudo при использовании настройки DigestSpec. Настройка DigestSpec может использоваться, чтобы разрешить пользователю выполнять sudo для бинарного файла, если и только...

CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111 – TOCTOU in File Permission Check Before Open Program Code Python root@kitploit: toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename...

BIT-TOMCAT-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1.0 through 10.1.57, from 9.0.42 through...

symboliclink-testing-tools

symboliclink-testing-tools c Google Inc. 2015 開発者: James Forshaw これは、Windowsのさまざまなシンボリックリンクの種類をテストするための小さなツール群です。以下のツールで構成されています： root@kitploit: BaitAndSwitch : シンボリックリンクを作成し、OPLOCKを使用してTOCTOU競合に勝利します CreateDosDeviceSymlink: csrssを使用してオブジェクトマネージャのシンボリックリンクを作成します CreateMountPoint:...

RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

PT-2026-90434

In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in writeback store Patch series "zram: fix stale scan bounds after reinitialization". Both writeback store and read block state derive their table scan bounds from zram-disksize before acquiring dev...