CVE-2026-64600

CVE-2026-64600 – RefluXFS Detection & Mitigation Tool This repository provides a comprehensive C utility to detect , safely verify , and mitigate the RefluXFS vulnerability CVE‑2026‑64600 on Linux systems running the XFS filesystem. The tool checks for a vulnerable kernel, identifies...

CVE-2026-64600-Refluxfs-PoC

RefluXFS CVE-2026-64600 PoC This repo contains a PoC of the recently discovered race condition vulnerability affecting COW on XFS reported by the excellent Qualys Security Team. 1 2 PoC info Handwritten based off of the excellent analysis in the Qualys advisory. Rewrites the first 4KB of the...

CVE-2025-6018-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit Local Privilege Escalation LPE - openSUSE / SUSE Linux Enterprise 15 Working PoC/Exploit for CVE-2025-6018 and CVE-2025-6019 - Privilege escalation from unprivileged user to root on openSUSE Leap 15.x and SUSE Linux Enterprise 15.x 🎯 Quick Summary CVE ID|...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 中文 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image...

CVE-2025-6019

CVE-2025-6019 Proof of Concept PoC This repository contains a Proof of Concept PoC script for CVE-2025-6019 , a Local Privilege Escalation LPE vulnerability in libblockdev and udisks. The script creates an XFS filesystem image with an SUID bash binary and exploits the vulnerability to mount it...

pterodactyl

Pterodactyl — HackTheBox 演练 平台： HackTheBox | 操作系统： Linux 攻击链 Pterodactyl Panel 暴露在一个子域上。CVE-2025-49132 路径遍历漏洞可在未认证的情况下泄露 Laravel 应用密钥和数据库凭据——破解提取出的哈希值即可获得 SSH 访问权限。权限提升链结合了 CVE-2025-6018（PAM 环境变量投毒以伪造图形化 polkit 会话）与 CVE-2025-6019（XFS 调整大小竞态条件以获取 root 权限的 SUID shell）。 枚举 虚拟主机枚举发现了一个 Pterodactyl...

CVE-2025-6018-and-CVE-2025-6019

Check Its Vulnerable or not root@kitploit: rpm -q pam || dpkg -l | grep libpam or find /etc/pam.d/ -name '' -exec grep -l 'pamenv' \; 2/dev/null or find /etc/pam.d/ -name '' -exec grep -l 'pamsystemd' \; 2/dev/null or systemctl --version | head -1 If version Include :Vulnerable PAM version...

CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation

CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation This is just a quick note on how to exploit these vulnerabilities to get root. Start by utilizing this tool on the attacker machine: https://raw.githubusercontent.com/ibrahmsql/CVE-2025-6018/refs/heads/main/CVE-202 You should now have a shell a...

CVE-2025-6018

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 中文 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Guide 📋 Quick Exploitation Steps Step 1: Prepare XFS Image Local Machine root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mn...

CVE-2026-90384

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-90384 iomap: release the folio batch on iomap callback failures

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-90384 iomap: release the folio batch on iomap callback failures

In the Linux kernel, the following vulnerability has been resolved: iomap: release the folio batch on iomap callback failures A sashiko review of an unrelated patch points out that the folio batch mechanism used for iomap zero range fails to release the batch in a couple error scenarios. If eithe...

CVE-2026-90384

CVE-2026-90384 affects the Linux kernel iomap subsystem. The folio batch mechanism used for iomap zero-range operations fails to release the batch when either ->iomap_end() or ->iomap_begin() callbacks fail, as the direct return paths bypass batch cleanup. The ->iomap_end() case is not p...

CVE-2025-6019

CVE-2025-6019: libblockdev Local Privilege Escalation Vulnerability Summary CVE-2025-6019 is a local privilege escalation LPE vulnerability discovered in the libblockdev library, which interacts with the udisks2 daemon and Polkit. Vulnerability Description A local attacker with allowactive Polkit...

CVE-2025-6019_Exploit

CVE-2025-6019Exploit Step 1: Run 1.sh on a Linux device to build xfs.image Step 2: Transfer xfs.image to the target device and execute 2.sh. Success is indicated as shown below: root@kitploit: neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko...

CVE-2025-6019

CVE-2025-6019 PoC Simple proof-of-concept for a UDisks2 XFS resize privilege escalation. Files createpayload.sh: Builds an XFS image with a SUID rootbash payload. exploit.sh: Triggers the resize path and launches the SUID shell. Requirements mkfs.xfs, udisksctl, gdbus, loginctl An allowactive...

CVE-2025-6019-udisks2-XFS-Resize-TOCTOU-Privilege-Escalation

CVE-2025-6019: udisks2 XFS Resize TOCTOU Privilege Escalation This repository contains a Proof of Concept PoC for CVE-2025-6019, a Race Condition vulnerability in udisks2 that allows local privilege escalation via XFS filesystem resizing. 🎯 Target Environments & Compatibility This exploit is...

CVE-2025-6019-udisks-lpe-no-image

CVE-2025-6019-udisks-lpe-no-image Script-only privilege escalation chain using CVE-2025-6019 and UDisks2 no filesystem image included. Credits, Context & Exploit Chain This repository does not introduce a new vulnerability. The privilege-escalation technique implemented here is fully based on...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: mm, thp: Bail out early for writeback pages in collapsefile Currently, collapsefile does not explicitly check PGwriteback. Instead, pagehasprivate and trytoreleasepage are used to filter writeback pages. This approach does not wo...