DEBIAN-CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

CVE-2026-93229

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpcstatusget dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsdnlrpcstatusgetdumpit is missing a read memory barrier smprmb before its second counter check. The standard kernel...

DEBIAN-CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93221

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

AZL-103946 CVE-2026-93221 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

DEBIAN-CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93218

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2021-1732-EXP-

このリポジトリには README がありません。...

CVE-2021-25741

概要 これはCVE-2021-25741の脆弱性に対するエクスプロイトです。 この脆弱性により、読み書き権限を持つNodeファイルシステムを新しいPOD内にマウントすることが可能になります。 この脆弱性の詳細については、以下をご覧ください: https://security.googleblog.com/2021/12/exploring-container-security-storage.html 私はこの脆弱性の作者ではなく、エクスプロイトを作成しただけです。 エクスプロイトの開発に協力してくれた@russtoneと@maximusfoxに感謝します。 条件 1...

CVE-2021-4034

CVE-2021-4034 Qualysチームによるpwnkit脆弱性のエクスプロイトです。 このエクスプロイトは、ターゲットマシンにgccが存在することを前提としています。 root@kitploit: $ id uid=1001ayrx gid=1002ayrx groups=1002ayrx,27sudo $ ./setup.sh 1つのbashセッションで以下のコマンドを実行します: root@kitploit: while :; do mv "GCONVPATH=./value" "GCONVPATH=./value.bak"; mv "GCONVPATH=./value.ba...

CVE-2026-97521 gfs2: fix quota init duplicate scan

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used gfs2qdsearchbucket, which takes a lockref reference via...

EUVD-2026-86119

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix quota init duplicate scan gfs2quotainit checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used gfs2qdsearchbucket, which takes a lockref reference via...

CVE-2026-97514 media: chips-media: wave5: Fix Reports from Kernel Lock Validator

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handledynamicresolution change requires that the statelock be acquired based on the lockdepassertheld. However, the handledynamicresolutionchange call in...

CVE-2026-97514

The Linux kernel contains a vulnerability within the chips-media: wave5 media driver. The issue stems from the handle_dynamic_resolution_change call in initialize_sequence, which fails to properly acquire the state_lock before execution, triggering reports from the Kernel Lock Validator . Because...

EUVD-2026-86112

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Fix Reports from Kernel Lock Validator handledynamicresolution change requires that the statelock be acquired based on the lockdepassertheld. However, the handledynamicresolutionchange call in...

CVE-2026-97499 coresight: perf: Retrieve path and source from event data

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

EUVD-2026-86097

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

CVE-2026-97499

The Linux kernel contains a vulnerability in the coresight: perf component. The issue arises because ETM perf callbacks currently use the per-CPU csdev_src pointer , which is susceptible to a race condition during device registration and unregistration. To resolve this, the fix utilizes the path ...

ksmbrace

ksmbrace ksmbd （Linuxカーネルのカーネル内SMB3サーバー、fs/smb/server/）における脆弱性研究です。ksmbdのdurableハンドルとパス解決の経路における、認証済み攻撃者が悪用できる欠陥を扱います。この名前は、この一連の研究のテーマである競合状態（race condition）に因んでいます（未公開のバイト範囲ロックUAF、CVE-2026-64396、d20d1c8ba576で修正済みを参照）。...

EUVD-2026-86076

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrnirqfddeassign and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd: CPU0 CPU1 ---- ---- eventfdrelease wakeuppollEPOLLHUP hsmirqfdwakeup...