CVE-2023-22098

CVE-2023-22098 - Oracle VM VirtualBox 7.0.10 r158379 Escape Hey VM Wizards, In 2023, the outstanding security researcher Andy Nguyen @TheFlow0 discovered multiple vulnerabilities in Virtio-net for VirtualBox. All kudos to him for his incredible work. This repository contains the exploit for...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix misalignment bug in struct virtnetinfo Use the new TRAILINGOVERLAP helper to fix a misalignment bug along with the following warning: drivers/net/virtionet.c:429:46: warning: structure containing a flexible array...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. This is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don’t overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. Meanwhile, GSOMAXSIZE = 8 GSOMAXSEGS = 8...

CVE-2026-99999

CVE-2026-99999 PwnEscape — Linux Kernel IPv4 csumstart Validation Bug PoC Linux kernel IPv4 header corruption via malformed virtio-net checksum metadata. CVSS 9.3 CRITICAL | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Discovered by Paulos | CNA: kernel.org | Published: 2026-10-15 ⚠️ This is an...

CVE-2026-99999-analysis

CVE-2026-99999 — Technical Analysis & Attack Chain Study ⚠️ This is the educational/analysis repository. It demonstrates the CVE-2026-99999 attack chain locally no network, no root, no real exploit. 🔴 Host-side PoC + harness: → CVE-2026-99999-exploit end-to-end guest→host trigger is not verified...

Amazon Linux 2023 : qemu, qemu-common, qemu-guest-agent (ALAS2023-2026-3241)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3241 advisory. hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE:...

Important: qemu

Issue Overview: hw/usb/hcd-xhci: Set reentrancy guard in timer functions CVE-2026-17588 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3 NOTE: Fixed by:...

Medium: qemu

Issue Overview: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 v11.0.4 CVE-2026-18054 NOTE:...

Amazon Linux 2 : qemu (ALAS-2026-4009)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4009 advisory. NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba v11.1.0-rc3NOTE: Fixed...

PT-2026-121926

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network subsystem where GSO Generic Segmentation Offload packets without the VIRTIO NET HDR F NEEDS CSUM flag may bypass flow dissection in the virtio net hdr to s...

CLSA-2025-1747430081 Fix of 47 CVEs

CVE-url: https://ubuntu.com/security/CVE-2021-47352 - virtio-net: Add validation for used length CVE-url: https://ubuntu.com/security/CVE-2024-46745 - Input: uinput - reject requests with unreasonable number of slots CVE-url: https://ubuntu.com/security/CVE-2024-44952 - driver core: Fix ueventsho...

CLSA-2025-1762332910 kernel: Fix of 4 CVEs

ext4: fix possible UAF when remounting r/o a mmp-protected file system CVE-2021-47342 - ext4: fix memory leak in ext4fillsuper - net: defer final 'struct net' free in netns dismantle CVE-2024-56658 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - ALSA: usb-audio: Fix an...

Exploit for CVE-2026-99999

CVE-2026-99999 — Technical Analysis & Attack Chain Study Li...

Exploit for CVE-2026-99999

CVE-2026-99999 KVM checksum metadata non-destructive PoC This...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdiscresetalltxgt vs dequeue race for lockless qdiscs When reducing the number of real TX queues, netifsetrealnumtxqueues calls qdiscresetalltxgt to flush qdiscs for queues that will no longer be used. Currently...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: virtionet: fix xdprxqinfo bug after suspend/resume The following sequence currently causes a driver bug warning when using virtionet: ip link set eth0 up echo mem /sys/power/state or e.g. rtcwake -s 10 -m mem ip link set eth0 dow...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: virtionet: a memory leak inside XPDTX has been fixed using mergeable. When we call xdpconvertbufftoframe to obtain xdpf, if it returns NULL, we should check whether xdppage was allocated by xdplinearizepage. If it was newly...

CVE-2026-90063

A flaw was found in virtio-net, a network virtualization driver in the Linux kernel. A local user could exploit this vulnerability by crafting a specially designed TCP packet with a small gsosize value. This action could lead to an integer overflow in the gsosegs field during packet processing,...

CVE-2026-98233 net/packet: clear RX owner on VNET header error

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...