CVE-2026-90210 bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpftrampolinemultiattachfree on update failure When bpftrampolineupdate fails before modifyfentrymulti/ unregisterfentrymulti is called, curimage is unchanged curimage == oldimage and ftrace still calls into it...

CVE-2026-90210

CVE-2026-90210 is a Use-After-Free (UAF) in the Linux kernel's BPF trampoline subsystem , specifically in bpf_trampoline_multi_attach_free. When bpf_trampoline_update() fails before modify_fentry_multi() or unregister_fentry_multi() is called, cur_image remains equal to old_image and ftrace conti...

CVE-2026-90201

CVE-2026-90201 is a Use-After-Free in the Linux kernel's net: page_pool subsystem. The bug occurs when page_pool_scrub() iterates pool->dma_mapped without holding a page reference concurrently with a page return via page_pool_put_netmem() on a different CPU. A losing xa_cmpxchg() caller frees ...

EUVD-2026-81794

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration ethtool -L / ethtool -G with iperf3 traffic on arm64. The race is...

EUVD-2026-81782

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

CVE-2026-90162 ksmbd: defer publishing granted locks to prevent UAF/double-free race

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race In smb2lock, mid-batch granted locks are published to connection-wide conn-locklist and file-wide fp-locklist lists immediately upon vfslockfile success, while...

CVE-2026-90162

CVE-2026-90162 is a Use-After-Free and Double-Free race condition in the Linux kernel's ksmbd (in-kernel SMB server) component, specifically in smb2_lock(). Mid-batch granted locks are published to conn->lock_list and fp->lock_list immediately upon vfs_lock_file() success while also remaini...

CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

EUVD-2026-81733

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

RootMyVivo-Exploit

RMV Exploit — compilación limpia de CVE-2026-43499 para iQOO Neo 11 PD2520 Fork de boxiaolanya2008/CVE-2026-43499-Neo11Plus, reelaborado para RootMyVivo Neo: se eliminó todo lo que no necesita nuestro escenario, se conservó el núcleo verificado del exploit sin cambios en los timings. Qué se elimi...

ghostlock-pfem10

GhostLock — PFEM10 Exploit de CVE-2026-43499 IonStack para OPPO Find X5 Pro PFEM10. Kernel 5.10.236-android12-9-o, futex CMPREQUEUEPI UAF → primitiva de escritura en pi-tree. Úsalo bajo tu propio riesgo. Espera panics / reinicios. No actualices el firmware. Compilación root@kitploit: ./build.sh...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable CVE gives a short-lived kernel read/write primitive, which late-loads a KernelSU module kernelsu.ko into the running GKI...

CVE-2026-90045

In the Linux kernel, the following vulnerability has been resolved: U...

asus-i005-cve-2026-43499

asus-i005-cve-2026-43499 CVE-2026-43499 GhostLock 在 ASUS ROG Phone 5S ASUSI005 上的适配研究。 结论：漏洞触发与栈回收完整验证；提权链被 KASLR leak 阻断。 TL;DR 阶段| 内容| 状态 ---|---|--- 0| UAF 触发（3 线程 + CMPREQUEUEPI）| ✅ 1| pselect timeout=0 栈回收（shift=10）| ✅ 1.6| W 内核栈 SP 泄漏（perf PERFSAMPLEREGSINTR）| ✅ 2| 任意地址写（需 KASLR slide）| ❌ —...

CVE-2026-90045

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling iodata stores a pointer to the submitting task's mmstruct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

root-s24-e1s

Root S24 e1s / S921BXXSDCZB2 Root local por arranque en Galaxy S24 SM-S921B con firmware S921BXXSDCZB2 kernel 6.1.138-android14-11, y posterior carga tardía de KernelSU Next para que com.rifsxd.ksunext informe de LKM en funcionamiento. No está afiliado a Root My Galaxy. Sin feed de payloads de...

ghostlock-cve-2026-43499

CVE-2026-43499 GhostLock — ARM32 Kernel Privilege Escalation Research Linux kernel futex PI rtmutex Use-After-Free vulnerability research and exploit development targeting Huawei Watch 4 Pro MDS-AL00 , Snapdragon SW5100, armv7l, kernel 5.4.210. Vulnerability removewaiter in kernel/locking/rtmutex...

ghost-hoock

ghost-hoock Un fork mínimo de GhostLock que conserva solo una primitiva : desactivar SELinux mediante CVE-2026-43499 futex PI UAF. ghost-hoock ejecutándose en un Samsung A17 -green Tabla de contenidos Qué es esto Cómo funciona Qué se conservó del original Qué se eliminó Compilación Ejecución...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — PoC de CVE-2026-43499 kernel 4.19 de Qualcomm Escalada de privilegios local que explota CVE-2026-43499 — un bug en removewaiter de rtmutex que deja un struct rtmutexwaiter colgando en la pila del kernel del waiter kernel/locking/rtmutex.c, use-after-free CWE-416. Adaptado de...