CVE-2026-93222

The Linux kernel contains a vulnerability where the send_signal_locked() function rewrites sender IDs for the target namespace. Because group sends reuse the same siginfo structure, one recipient can inadvertently affect the next. The issue is resolved by copying the siginfo before modification. ...

EUVD-2026-86225

In the Linux kernel, the following vulnerability has been resolved: signal: avoid shared siginfo namespace rewrites sendsignallocked rewrites sender ids for the target namespace. Group sends reuse the same siginfo, so one recipient can affect the next. Copy the siginfo before changing it...

CVE-2026-93221 nfsd: convert nfsd_net boolean flags to unsigned long flags word

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93221 nfsd: convert nfsd_net boolean flags to unsigned long flags word

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93221

The Linux kernel is vulnerable to a race condition in the nfsd component due to a lack of serialization when accessing boolean fields in nfsd_net. Specifically, the nfsd4_end_grace() function uses a plain boolean for grace_ended, allowing concurrent paths—such as the laundromat path and the RECLA...

EUVD-2026-85950

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93218 mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

EUVD-2026-85947

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: skip device-private PMDs in madvisefreehugepmd madvisefreepterange checks pmdtranshugepmd unlocked, then madvisefreehugepmd takes pmdtranshugelock. pmdishuge returns true for a device-private PMD, so origpmd can be...

CVE-2026-93218

The Linux kernel contains a vulnerability in the mm/huge_memory component related to how it handles device-private Page Middle Directories (PMDs). A race condition occurs when an HMM-based GPU driver interacts with madvise(MADV_FREE). Specifically, migrate_vma_pages() can flip a PMD to a device-p...

CVE-2026-93217 mm/madvise: skip device-private PMDs in cold and pageout walks

In the Linux kernel, the following vulnerability has been resolved: mm/madvise: skip device-private PMDs in cold and pageout walks madvisecoldorpageoutpterange takes pmdtranshugelock, whose pmdishuge check returns true for a device-private PMD. The subsequent !pmdpresent branch has a VMBUGON...

CVE-2026-93208

The Linux kernel contains a race condition in KASAN involving cache shrinking and CPU hotplug . Specifically, kmem_cache_shrink() fails to hold the cpus_read_lock(), allowing a race where objects are moved to a CPU's shrink_qlist just before that CPU goes offline. Because the offline CPU's list i...

cve-2026-41940-cpanel_authbypass_reproduction

CVE-2026-41940 — cPanel & WHM 認証バイパス CVSS v3.1: 9.8 緊急 概要 CVE-2026-41940 は、cPanel & WHM における重大な認証バイパス脆弱性であり、認証されていない攻撃者がコントロールパネルへの完全な管理者アクセスを取得することを可能にします。この脆弱性は、公開から 24 時間以内に実環境で悪用され、脆弱なホストに対してランサムウェアが展開されました。これは、watchTowr の研究者によって発見され、公開されました。 技術的詳細 cPanel/WHM...

CVE-2023-31443

CVE-2023-31443 nordugrid-arc-wn 6.14.0 DoS/LPE。 推奨される説明 NorduGrid nordugrid-arc-wn 6.14.0 には、パストラバーサル攻撃に対して脆弱な arc-job-cgroup SUID バイナリがあります。 競合状態と組み合わせることで、攻撃者は root ユーザーが書き込み可能な任意のファイルに ppid を書き込むことができます。 脆弱性タイプ ディレクトリトラバーサル 製品のベンダー NorduGrid 影響を受ける製品コードベース nordugrid-arc-wn - 6.14.0 影響を受けるコンポーネ...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

CVE-2016-8655

ocoboroot.c Linux AFPACKET レースコンディションエクスプロイト Ubuntu 16.04 x8664 向けエクスプロイト user@ubuntu:$ gcc chocoboroot.c -o chocoboroot -lpthread user@ubuntu: $ ./chocoboroot making vsyscall page writable.. new exploit attempt starting, jumping to 0xffffffff8106f320, arg=0xffffffffff600000 sockets allocated...

Dirty-COW-CVE-2016-5195-

Dirtyc0w Docker POC 前提条件: Vagrant がインストールされていること 使い方 まずプロジェクトをクローンします git clone https://github.com/BrolyCode/Dirty-Cow.git フォルダーに入ります cd Dirty-Cow 次に、以下のコマンドで環境を起動します root@kitploit: vagrant up サーバーが構築されたら、SSH で接続します root@kitploit: vagrant ssh root ユーザーに切り替えます root@kitploit: sudo -i...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...