CVE-2025-6019

CVE-2025-6019 概念验证 PoC 此仓库包含针对 CVE-2025-6019 的概念验证 PoC 脚本，该漏洞是 libblockdev 和 udisks 中的本地权限提升 LPE 漏洞。该脚本创建一个包含 SUID bash 二进制的 XFS 文件系统镜像，并利用该漏洞在不使用 nosuid 选项的情况下挂载它，从而获得 root shell。 警告 ：此 PoC 仅用于教育和测试目的。只能在您有权测试的系统上使用。未经授权使用是非法且不道德的。 特性 本地模式 ：创建一个 300 MB 的 XFS 镜像，包含 SUID bash 二进制（需要 root 权限）。 目标模式...

CVE-2026-64600-Refluxfs-PoC

RefluXFS CVE-2026-64600 PoC 该仓库包含最近发现的、影响 XFS 上 COW 的竞态条件漏洞的概念验证（PoC），该漏洞由优秀的 Qualys 安全团队报告。1 2 PoC 信息 根据 Qualys 公告中出色的分析手工编写。该脚本将 /etc/passwd 文件的前 4KB 重写为其原始内容， 并将 root 用户行：root:x:0:0:root:/root:/bin/bash 替换为 root::0:0:root:/root:/bin/bash。注意到区别了吗？现在 root 用户没有密码，你可以直接执行 su -。 这是一个为满足自身需求而写的粗糙...

CVE-2025-6019_Exploit

CVE-2025-6019Exploit Primer paso: ejecute 1.sh en el dispositivo Linux para construir xfs.image Segundo paso: transfiera xfs.image al dispositivo víctima y ejecute 2.sh; lo siguiente indica que se ha logrado neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko...

CVE-2025-6019-udisks-lpe-no-image

CVE-2025-6019-udisks-lpe-no-image 仅使用脚本的权限提升利用链，基于 CVE-2025-6019 与 UDisks2（不包含文件系统镜像）。 鸣谢、背景与利用链 本仓库并未引入新的漏洞。 此处实现的权限提升技术完全基于先前已发表的研究。 我未能找到一种无需在目标上创建镜像即可运行的现有脚本，这促使我编写了此自动化脚本。 原始研究与公告 根本原因分析、利用流程和缓解指导均由原始 CVE 作者研究并披露： 🔗 https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt...

CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation

CVE-2025-6018 和 CVE-2025-6019 权限提升 这只是一份关于如何利用这些漏洞获取 root 权限的快速说明。 首先在攻击机上使用此工具： https://raw.githubusercontent.com/ibrahmsql/CVE-2025-6018/refs/heads/main/CVE-202 现在你应该获得一个用户权限的 shell。如果在 HTB 上失败，如果可以的话，只需重启机器。 然后在攻击机上以 sudo 权限本地使用此脚本（使用选项 L 生成）：...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 权限提升指南 📋 快速利用步骤 步骤1：在本地机器上准备XFS镜像 Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mnt sudo cp /bin/bash mnt/bash sudo chmod 4755 mnt/bash sudo umount mnt rmdir...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: filemap: Avoid truncating the 64-bit offset to 32 bits. On 32-bit kernels, the folioseekholedata function inadvertently truncated a 64-bit value to 32 bits, which could lead to an infinite loop when writing to an xfs filesystem...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfs: Save the ailp pointer before releasing the AIL lock during push callbacks. In xfsinodeitempush and xfsqmdquotlogitempush, the AIL lock is released to perform buffer I/O operations. Once the cluster buffer no longer protects...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iomap: Avoid truncating the 64-bit offset to 32 bits. On 32-bit kernels, iomapwritedelallocscan inadvertently used a 32-bit position due to folionextindex returning a unsigned long value. This could lead to an infinite loop when...

Astra Linux – Vulnerability in Linux, Linux 5.10

A data leak flaw was discovered in the way of the XFSIOCALLOCSP IOCTL in the XFS filesystem, which allows for an increase in file sizes when the size is unaligned. A local attacker could exploit this flaw to leak data from the XFS filesystem that would otherwise be inaccessible to them...

Astra Linux – Vulnerability in Linux, Linux 5.10

A vulnerability was discovered in the fs/inode.c:inodeinitowner function logic of the Linux kernel. This vulnerability allows local users to create files for the XFS file system with unintended group ownership, along with group execution and SGID permission bits set. This occurs in a scenario whe...

Linux Distros Unpatched Vulnerability : CVE-2026-80804

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the succe...

SUSE CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

SUSE CVE-2026-80805

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80820 xfs: don't livelock in scrub on a circular unlinked list

In the Linux kernel, the following vulnerability has been resolved: xfs: don't livelock in scrub on a circular unlinked list LOLLM points out that online fsck can livelock if an unlinked inode list contains a loop. Use a bitmap to detect cycles...

CVE-2026-80805

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

EUVD-2026-71240

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

EUVD-2026-71239

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...