2219 matches found
CVE-2026-43499-armv7
CVE-2026-43499 GhostLock — ARM32 Huawei Watch 4 Pro Linux kernel privilege escalation exploit attempt based on CVE-2026-43499 GhostLock — Huawei Watch 4 Pro MDS-AL00, armv7l Project Overview This project is a GhostLock kernel vulnerability exploit attempt targeting the Huawei Watch 4 Pro MDS-AL00...
CyberMeowfia
Website: nebusec.ai · Twitter @nebusecurity · Bug list 885+ IonStack followup, follow https://github.com/NebuSec/CyberMeowfia/issues/44 Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel 📖 Writeup · 🐦 Twitter Longinus : ...
UnPlus
unplus CVE-2026-43499 Futex PI UAF kernel arbitrary-address-write exploit core logic code, used to bypass SELinux and gain root. This repository only contains the core exploit logic source src/ and the single-binary packager wrapper/. src/target.h is a template ; you must fill in parameters for...
GhostLock-for-OnePlus15T
GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...
CyberMeowfia-ace3
Website: nebusec.ai · Twitter @nebusecurity · Bug list 885+ IonStack followup, follow https://github.com/NebuSec/CyberMeowfia/issues/44 Latest research IonStack part II : GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Linux Kernel 📖 Writeup · 🐦 Twitter Longinus : ...
oppo-ghostlock
oppo-ghostlock GhostLock CVE-2026-43499 — OPPO Find N2 Linux Kernel Privilege Escalation Research Project Overview GhostLock CVE-2026-43499 is a kernel stack UAF vulnerability affecting Linux 2.6.39 through 7.1-rc1, triggered via a FUTEXCMPREQUEUEPI race condition. This project ports the x8664...
CVE-2022-41218
Introduction This vulnerability is a race condition vulnerability that occurs in drivers/media/dvb-core/dmxdev.c. Therefore, a race condition may occur in the usb device driver using this dmxdev. This vulnerability could be used to trigger 3 UAFs. Vulnerability 1. vmalloc UAF write First, the...
GhostLock-for-OnePlus
GhostLock — OnePlus Kernel exploit targeting locked-bootloader OnePlus devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Table of Contents Vulnerability Overview Supported Devices...
Vulnerability_PoC
The PoC/Exploit of some interesting vulnerabilities Author: Vulnerability Research Team of Numen Cyber Labs 1. TCP/IP RCE Vulnerability CVE-2022–34718 PoC Restoration and Analysis...
onetwoseven-writeup
HTB OneTwoSeven — Full Walkthrough A complete, end-to-end walkthrough of OneTwoSeven , a retired HackTheBox Linux machine. The full chain: deterministic credential generation → symlink escape of an SFTP chroot → vim swap file recovery → SSH port-forwarding to a firewalled admin panel → bypass of...
PS5-IPV6-Kernel-Exploit
PS5 3.xx / 4.xx Kernel Exploit Summary This repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on TheFlow's IPV6 Use-After-Free UAF , which was reported on HackerOne. The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to...
ghostlock-oppo-watch3pro
GhostLock CVE-2026-43499 — OPPO Watch 3 Pro 完整研究案例 对 OPPO Watch 3 Pro OWW211, ColorOS Watch 国行, Android 11, ARM32 上 CVE-2026-43499 GhostLock, rtmutex/futex-PI 栈 UAF 的完整利用研究。 最终结论:链走写入机制在 OPPO 00522 msm-5.4 重构版 rtmutex 上触发即崩溃, 无法完成利用 。所有触发方式(T2 requeue / schedsetattr)实机验证均 panic; 且...
ghostlock-kit
GhostLock Kit — vivo iQOO Neo9S Pro V2339FA / MT6989 适用于 vivo iQOO Neo9S Pro(V2339FA,MediaTek MT6989) 的 GhostLock 一键 root 套件。 本仓库包含:MCAST transport 移植补丁 、一键脚本、完整分析文档;完整可运行套件(含二进制与 KernelSU)见 Releases。 Device: vivo iQOO Neo9S Pro V2339FA / PD2339, MT6989 Firmware: PD2339A16.2.12.1.W10.V000L1 Andro...
iqoo-temp-root
vivo/iQOO Temporary Root Toolkit No bootloader unlocking, no flashing needed, temporary root lost on reboot. Core principle: CVE-2026-43499 futex PI UAF kernel exploit + temporary KernelSU loading. Supported devices App version Device| Codename| Payload ---|---|--- iQOO Z10 Turbo| z10t / iqooz10t...
GhostLock-GOT-W29
CVE-2026-43499 GhostLock — HUAWEI MatePad Pro 11 GOT-W29 针对 GOT-W29(HarmonyOS 4.0, kernel 4.19.157-perf+)上 CVE-2026-43499 (rtmutex/futex-PI 栈 UAF,"GhostLock")的提权研究。 最终结论 1. 漏洞真实且可触发 :值持有 PI 环使 FUTEXCMPREQUEUEPI 返回 -EDEADLK, 回滚路径激活 removewaiter 的 current != waiter-task 清理 bug(本内核...
GhostLock
GhostLock - CVE-2026-43499 Local Privilege Escalation Exploit Vulnerability Overview CVE ID: CVE-2026-43499 Vulnerability Type: futex PI priority inheritance stack UAF Use-After-Free Affected Range: Linux kernel 6.1 6.12 Android GKI Exploitation Impact: Local privilege escalation + SELinux disabl...
EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2026-3424)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : kernel:SUNRPC: fix a memleak in gssimportv2contextCVE-2023-52653 apparmor: Fix null pointer deref when receiving skb during sock...
Linux Distros Unpatched Vulnerability : CVE-2026-90392
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is...
Linux Distros Unpatched Vulnerability : CVE-2026-90423
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails,...
Linux Distros Unpatched Vulnerability : CVE-2026-90393
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix potential UAF in bpfnetnslinkupdateprog In bpfnetnslinkupdateprog, the checks for oldprog and prog type are currently performed locklessly before...