dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Escalada local de privilegios universal en el kernel de Linux 📋 Resumen Dirty Frag también conocido como Copy Fail 2 es una vulnerabilidad de escalada local de privilegios de alto impacto en el kernel de Linux. Permite que un usuario local sin privilegios obtenga...

CVE-2022-22706-poc

CVE-2022-22706 - 页缓存写入 Arm Mali GPU 驱动会将已固定为只读的页面以 CPU 可写映射的形式交给用户空间， 因此非特权进程可以获得一个可写别名，指向某个它只能以 ORDONLY 打开的文件 背后的页缓存。 exploit.c 会清空 /etc/passwd 页缓存中 root 的密码字段，并执行 su root。磁盘上的文件从未被修改。 针对本仓库中的驱动树和 QEMU 目标的 PoC（malikbase r35p0-01eac0 ， CONFIGMALINOMALI=y，x8664 GKI 5.15）。在虚拟机中运行它。 漏洞...

CVE-2026-43284

Dirty Frag: LPE universal en Linux Abstract Este documento explica la clase de vulnerabilidad Dirty Frag, descubierta y reportada por Hyunwoo Kim @v4bel. Al encadenar xfrm-ESP Page-Cache Write CVE-2026-43284 con RxRPC Page-Cache Write CVE-2026-43500, un atacante puede escalar a root en las...

CVE-2026-89487

A flaw was found in openvswitch in the Linux kernel. This vulnerability occurs when the queueuserspacepacket function incorrectly modifies a shared network packet buffer by stripping a critical flag. This action can lead to an unprivileged page-cache write, allowing a local attacker to modify dat...

Linux Distros Unpatched Vulnerability : CVE-2026-89487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message users...

cve-2026-31431

CVE-2026-31431 — Fallo de "copia" en algifaead del kernel Linux: Análisis Investigación de seguridad sobre CVE-2026-31431 CVSS 3.1 7.8 ALTO , AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: tres fallos de diseño componibles en la cadena AFALG AEAD se combinan en una escritura determinista y sin condiciones ...

DEBIAN-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100568 CVE-2026-89487 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

EUVD-2026-76393

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

CVE-2026-89487 affects the openvswitch subsystem in the Linux kernel. The bug resides in queue_userspace_packet(), whose error path calls skb_tx_error() on a packet that is still being forwarded through remaining flow actions. This call strips SKBFL_SHARED_FRAG from the live skb via skb_zcopy_cle...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

PT-2026-90203

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skb tx error a packet we are about to drop queue userspace packet borrows the packet skb -- it only copies it into a private netlink message user skb and does not own it; on return do execute actions keeps...

CVE-2026-43284-dirtyfrag-detection

DirtyFrag CVE-2026-43284 PoC 検証と auditd 検出 範囲: CVE-2026-43284 に関連する XFRM/ESP パスに焦点を当てた Linux ローカル権限昇格 LPE 検証。 このリポジトリには、公開されている DirtyFrag PoC の制御されたラボ検証からの英語レポートと証拠成果物が含まれています。ここでは、エクスプロイトガイドを提供することではなく、Linux 監査ログで何が可視であったか、およびそれらのイベントを実用的な SOC 検出ロジックに変換する方法を文書化することに焦点を当てています。 完全な PDF レポート: EN:...

copy-fail-CVE-2026-31431-poc

CVE-2026-31431 — Copy Fail 概念验证 本仓库包含针对 CVE-2026-31431 的概念验证（PoC）漏洞利用代码，这是一个高严重性的 Linux 内核本地权限提升漏洞，允许任何无特权的本地用户获得 root 访问权限。该漏洞被命名为“Copy Fail”，位于 algifaead 模块中，可与 AFALG 套接字接口和 splice 系统调用链式利用，从而对任何可读文件（例如 setuid 二进制文件 /usr/bin/su）的页缓存执行受控的 4 字节写入。 该漏洞影响自 2017 年以来发布的几乎所有 Linux...

XCP_ng_CVE-2026-31431_tester

CVE-2026-31431 "Copy Fail" — Detector de laboratorio para XCP-ng Un script detector seguro y no destructivo para CVE-2026-31431 "Copy Fail", validado contra XCP-ng 8.3 LTS anterior a la actualización de seguridad del 5 de mayo de 2026. ⚠️ Solo uso autorizado. Ejecute este script exclusivamente en...

CVE-2026-31431-PoC

CVE-2026-31431 PoC Linux 内核中通过 algifaead 页缓存写入实现本地权限提升（“Copy Fail”） 作者： Van Glenndon Enad 原始发现： Theori / Xint Code 研究团队（Taeyang Lee） 发布时间： 2026 年 4 月 29 日 严重性： 高 CVSS v3.1 评分： 7.8 CVSS v3.1 向量： CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE： CWE-787（越界写入）、CWE-269（权限管理不当） 目录 1. 执行摘要 2. 受影响软件 3...