114 matches found
CVE-2026-99225 keys: Check the authorization payload in process keyring searches
In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...
ticket_converter
This script is no longer supported Use the impacket example ticketConverter.py. ticketconverter A little tool to convert ccache tickets into kirbi KRB-CRED and vice versa based on impacket. As input you must provide a ccache or kirbi file. The script will detect the format and convert it...
Linux_LPE_eBPF_CVE-2021-3490
LinuxLPEeBPFCVE-2021-3490 LPE exploit for CVE-2021-3490. Tested on Ubuntu 20.04.02 and 20.10 Groovy Gorilla kernels 5.8.0-25.26 through 5.8.0-52.58. and Ubuntu 21.04 Hirsute Hippo 5.11.0-16.17. The vulnerability was discovered by Manfred Paul @manfp and fixed in this commit. author: @chompie1337...
CVE-2024-0582
Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...
CVE-2017-16995
CVE-2017-16995 tested for Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size...
CVE-2021-4204
CVE-2021-4204 Chinese writeup: https://tr3e.ee/posts/cve-2021-4204-linux-kernel-ebpf-lpe.txt For educational/research purposes only. Use at your own risk. Build & Run $ sh buildandrun.sh Build from source... cc -I include -static -w -o exploit exploit.c Start exploit! This might take some while...
ghostlock-custom
GhostLock Custom — CVE-2026-43499 Adaptation A GhostLock CVE-2026-43499 privilege escalation exploit targeting non-Android Linux 6.x ARM64 kernels. Kernel Characteristics Item| Value ---|--- Architecture| ARM64 AArch64 VABITS| 39 KIMAGETEXTBASE| 0xffffffc008000000 Kernel version| 6.x SELinux| Non...
Exploit for CVE-2026-89754
InfinityCore Android — CVE-2026-89754 MM Overview T...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: smb: client: rejecting descriptions of cifs.spnego in user space Descriptions of cifs.spnego keys contain fields that carry authority, such as pid, uid, creduid, and upcalltarget. The cifs.upcall treats these fields as...
Astra Linux – vulnerability in linux-5.15, linux-6.1
In the Linux kernel, the following vulnerability has been resolved: Landlock: Don’t lose track of restrictions on credtransfer When a process’s cred struct is replaced, this almost always invokes the credprepare LSM hook; however, in one special case when KEYCTLSESSIONTOPARENT updates the parent’...
PT-2026-108201
Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 krb5 versions prior to 1.22.3 Description A NULL pointer dereference occurs in the make cred list function within rd cred.c. Authenticated Kerberos clients can trigger this by sending mismatched KRB-CRED arrays. Specifically, an...
PT-2026-115726
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIO CRED credit-return mmap hfi1 file mmap's PIO CRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...
PT-2026-106545
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hfi1 file mmap function within the IB/hfi1 driver regarding the PIO CRED credit-return memory mapping. The implementation contains two primary errors: first, it...
PT-2026-94655
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap information leak exists in the RDMA/srp component. The srp recv done function fails to pass the received byte length to srp process cred req and srp process aer req, which then re...
SUSE CVE-2026-80928
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...
SUSE CVE-2026-89762
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...
Linux Distros Unpatched Vulnerability : CVE-2026-80928
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must alwa...
Linux Distros Unpatched Vulnerability : CVE-2026-89762
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in...
DEBIAN-CVE-2026-89762
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...
AZL-100791 CVE-2026-89762 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...