CVE-2026-64600-Refluxfs-PoC

RefluXFS CVE-2026-64600 PoC 该仓库包含最近发现的、影响 XFS 上 COW 的竞态条件漏洞的概念验证（PoC），该漏洞由优秀的 Qualys 安全团队报告。1 2 PoC 信息 根据 Qualys 公告中出色的分析手工编写。该脚本将 /etc/passwd 文件的前 4KB 重写为其原始内容， 并将 root 用户行：root:x:0:0:root:/root:/bin/bash 替换为 root::0:0:root:/root:/bin/bash。注意到区别了吗？现在 root 用户没有密码，你可以直接执行 su -。 这是一个为满足自身需求而写的粗糙...

CVE-2025-6019-udisks-lpe-no-image

CVE-2025-6019-udisks-lpe-no-image 仅使用脚本的权限提升利用链，基于 CVE-2025-6019 与 UDisks2（不包含文件系统镜像）。 鸣谢、背景与利用链 本仓库并未引入新的漏洞。 此处实现的权限提升技术完全基于先前已发表的研究。 我未能找到一种无需在目标上创建镜像即可运行的现有脚本，这促使我编写了此自动化脚本。 原始研究与公告 根本原因分析、利用流程和缓解指导均由原始 CVE 作者研究并披露： 🔗 https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt...

CVE-2025-6019

CVE-2025-6019 概念验证 PoC 此仓库包含针对 CVE-2025-6019 的概念验证 PoC 脚本，该漏洞是 libblockdev 和 udisks 中的本地权限提升 LPE 漏洞。该脚本创建一个包含 SUID bash 二进制的 XFS 文件系统镜像，并利用该漏洞在不使用 nosuid 选项的情况下挂载它，从而获得 root shell。 警告 ：此 PoC 仅用于教育和测试目的。只能在您有权测试的系统上使用。未经授权使用是非法且不道德的。 特性 本地模式 ：创建一个 300 MB 的 XFS 镜像，包含 SUID bash 二进制（需要 root 权限）。 目标模式...

CVE-2025-6018-and-CVE-2025-6019-Privilege-Escalation

CVE-2025-6018 和 CVE-2025-6019 权限提升 这只是一份关于如何利用这些漏洞获取 root 权限的快速说明。 首先在攻击机上使用此工具： https://raw.githubusercontent.com/ibrahmsql/CVE-2025-6018/refs/heads/main/CVE-202 现在你应该获得一个用户权限的 shell。如果在 HTB 上失败，如果可以的话，只需重启机器。 然后在攻击机上以 sudo 权限本地使用此脚本（使用选项 L 生成）：...

CVE-2025-6018-CVE-2025-6019-Privilege-Escalation-Exploit

CVE-2025-6018 + CVE-2025-6019 权限提升指南 📋 快速利用步骤 步骤1：在本地机器上准备XFS镜像 root@kitploit: Create 300MB XFS image dd if=/dev/zero of=xfs.image bs=1M count=300 mkfs.xfs -f xfs.image Mount and install SUID bash mkdir mnt sudo mount -t xfs xfs.image mnt sudo cp /bin/bash mnt/bash sudo chmod 4755 mnt/bash sudo...

CVE-2025-6019_Exploit

CVE-2025-6019Exploit 第一步 在linux设备上运行1.sh,构建xfs.image 第二步 将xfs.image传入受害设备执行2.sh 如下即为成功 root@kitploit: neko@aosc-neko205 tmp $ bash 2.sh 当前用户: neko uid=1000neko gid=1001neko 组=1001neko,11audio,12video,15cdrom,974ollama,997wheel,999plugdev,1002gamemode 'yes', Mapped file /home/neko/xfs.image as...

Linux Distros Unpatched Vulnerability : CVE-2026-80804

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the succe...

SUSE CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

CVE-2026-80820 xfs: don't livelock in scrub on a circular unlinked list

In the Linux kernel, the following vulnerability has been resolved: xfs: don't livelock in scrub on a circular unlinked list LOLLM points out that online fsck can livelock if an unlinked inode list contains a loop. Use a bitmap to detect cycles...

CVE-2026-80805

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

EUVD-2026-71240

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

CVE-2026-80804

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

EUVD-2026-71239

In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context unconditionally in xfstransroll When xfstranscommit fails in xfstransroll, the NOFS context is cleared but only restored in the success path. This leaves the error path without nofs protection, causing a...

Linux Distros Unpatched Vulnerability : CVE-2026-80805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointe...

EUVD-2026-66449

In the Linux kernel, the following vulnerability has been resolved: xfs: fix ilock leak on error in xfsdqgetnextid xfsdqgetnextid takes the quota inode ILOCK before calling xfsireadextents. If xfsireadextents fails, the function returns immediately without releasing the lock, leaking the quota...

EUVD-2026-66445

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

EUVD-2026-66453

In the Linux kernel, the following vulnerability has been resolved: xfs: propagate errors from xfsrtginodeload xfsrtginodeensure treats every xfsrtginodeload error other than -ENOENT as success. This can leave the realtime group inode unset after an I/O, allocation, or corruption error. Growfs th...

CVE-2026-80529

A flaw was found in the Linux kernel's XFS filesystem. During dquot recovery, the xlogrecoverdquotcommitpass2 function fails to correctly propagate verification errors. This allows a corrupt quota buffer to be written back to disk, potentially leading to data corruption within the XFS filesystem...

CVE-2026-80530

A flaw was found in the Linux kernel's XFS filesystem. When performing file range exchanges with the XFSEXCHMAPSINO1WRITTEN flag set, the reflink flag can be prematurely cleared from an inode that still manages shared written data. This can lead to data corruption between files that share data...

CVE-2026-80533

A flaw was found in the Linux kernel's XFS filesystem. This vulnerability occurs during the Allocation Group Information AGI repair process, specifically in the xrepiunlinkwalkondiskbucket function. If the buffer verifier fails, a null pointer dereference can occur when attempting to rebuild...