CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 概念验证 — uid=1000raken → uid=0root 在 WSL2 6.6.87.2-microsoft-standard-WSL2 上执行 ./sley 后 针对 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一种 Linux 内核本地权限提升漏洞，它利用 RDS 零拷贝引用计数错误 与 iouring 固定缓冲区 链式攻击，覆写 SUID-root 二进制文件的页面缓存。 免责声明： 本仓库仅限 授权的安全研究、教育和防御性测试...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC（CVE-2026-43494） 概念验证 — uid=1000raken → uid=0root 执行 ./sley 后，在 WSL2 上（6.6.87.2-microsoft-standard-WSL2） 针对 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一个 Linux 内核本地权限提升漏洞，利用 RDS zerocopy 引用计数错误 结合 iouring 固定缓冲区 来覆盖 SUID-root 二进制文件的页缓存。 免责声明： 本仓库仅用于 授权的安全研究、教育和防御性测试...

pintheft

PinTheft — RDS 零拷贝双重释放 LPE 追踪站点 PinTheft 补丁状态追踪器的源码：一个单页站点，记录哪些发行版已针对 Linux 内核中的 RDS 零拷贝双重释放权限提升漏洞发布了修复。 事实在哪里 关于该漏洞的一切信息——CVE ID、受影响版本与修复版本、上游修复提交、发现与披露致谢，以及各发行版的最终补丁状态——均属于追踪器页面，而非本 README： 网页版： https://kimmo.cloud/pintheft/ 源码： site/content/index.md 编辑该文件；本仓库中的其余内容均为构建基础设施。 此处故意不重复这些内容。若在 READ...

CVE-2026-43494-PinTheft-PoC

SLEY — PoC de PinTheft CVE-2026-43494 Prueba de concepto — uid=1000raken → uid=0root después de ./sley en WSL2 6.6.87.2-microsoft-standard-WSL2 Prueba de concepto de un solo archivo para CVE-2026-43494 PinTheft: una escalada local de privilegios en el kernel de Linux que encadena un bug de conteo...

tcp-zerocopy-sm

Investigation is closed. Working fork: https://github.com/soumarcelino/Root-My-Galaxy-SM-S918B Read this - https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/issues/160issuecomment-5227077583 Attempts to cause rights elevation w GhostLock via TCP Zerocopy. Designed expecially for 5.15. samsung...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net: gro subsystem, do not merge the zcopy state when copying fragments between the source skb and the GRO skb. The skbgroreceive function currently copies fragments between the source skb and the GRO skb, without checking...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: TCP/UDP: Fixed memory leaks related to sk and zerocopy SKBS with TX timestamps. Syzkaller reported 0 memory leaks of an UDP socket and ZEROCOPY SKBS. We can reproduce this issue with the following sequence: sk = socketAFINET,...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net: stream module, the purge skerrorqueue operation in skstreamkillqueues has been fixed. Changheon Lee reported TCP socket leaks, with a detailed reproduction guide. It appears that we encounter TCP socket leaks in the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: opnents is reset when zerocopy page pin fails. When iovitergetpages2 fails in rdsmessagezcopyfromuser, the pinned pages are released using putpage, and rm-data.opmmpznotifier is cleared. However, we fail to properly clea...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: TX zerocopy should not access the pfmemalloc status. We received a recent syzbot report 1 indicating a possible misuse of the page status in TCP zerocopy paths. Indeed, for pages originating from user space or other layers,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-80977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged...

CVE-2026-80977

A flaw was found in the Linux kernel's networking subsystem. The skbtxerror function improperly handles shared zerocopy state in socket buffers skbs. When a cloned skb is processed, it can prematurely signal that its pages are free and drop shared fragment flags while the original skb is still in...

DEBIAN-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100568 CVE-2026-89487 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

DEBIAN-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

AZL-100274 CVE-2026-80977 affecting package kernel 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

UBUNTU-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...