CVE-2026-98383

The Linux kernel contains a vulnerability where an LWT_SEG6LOCAL program can invalidate its cached SRH using bpf_lwt_seg6_adjust_srh() and subsequently call bpf_skb_pull_data(). This sequence can cause skb->head to be reallocated, resulting in a dangling per-CPU SRH pointer . Subsequent post-p...

CVE-2026-46215-exploit-linux-7.0-uaf-stable

CVE-2026-46215 Linux 7.0 漏洞利用 - 更稳定、更可靠 c0d3 by : Antonius w1sdom / ev1lut10n / sw0rdm4n - bluedragonsec.com https://github.com/bluedragonsecurity 此漏洞利用仅在受限环境中有效，请查看下方的一些要求！！！ 这到底是什么鬼东西？ 这是针对 CVE-2026-46215（Linux 内核释放后使用漏洞）的漏洞利用，已适配 Linux 7.0！！！ 此漏洞利用比我发布的第一个漏洞利用更稳定、更可靠。 跨缓存技术：SheavesSiphon...

CVE-2025-14321

CVE-2025-14321 概念验证 描述 针对 Firefox 中 RTCEncodedFrameBase 组件的释放后使用 UAF 漏洞的概念验证 PoC，该漏洞可通过 WebRTC 编码转换 API 利用。 CVE-2025-14321 : RTCEncodedFrameBase 的析构函数在释放帧的本机内存时未调用 DetachArrayBuffer。因此，JavaScript 的 ArrayBuffer 仍保留指向已释放内存的指针（悬挂指针），允许对 Firefox 内容进程堆进行任意读写。 此 PoC 已在 Mozilla Firefox 145.0.1 和 Windows...

CVE-2020-17057

我基于这篇博客（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html）编写了这个 exp，但最终只得到了带有悬空数据指针的 palette 对象。 由于类型隔离，我无法通过使用 palettes 或 bitmap 对象来获得任意读/写原语，如果你有办法获得任意读/写原语或继续编写 这个 exp，请联系我，谢谢...

CVE-2023-20938

CVE-2023-20938 English 漏洞分析 1. client A与client B通过上下文管理器servicemanager建立Binder连接 2. A创建node 0xbeefnode = bindernewnodeproc, fp;，B通过ref-targetnode引用node 0xbeef 3. B先正确处理targetnode 0xbeef，将引用了targetnode 0xbeef的事物bindertransaction存入A的事物队列binderenqueueworkilocked&t-work, &proc-todo;，使A可以再次引用被释放的悬挂指针 ...

CVE-2026-43499-poc

CVE-2026-43499 （ghostlock）的武器化研究。 这是 rtmutex removewater 代理路径中的一个 bug，它会导致任务的 piblockedon 悬空并指向其自身已弹出的内核栈帧。 该 bug 类别和原始利用策略归功于 nebusec （他们的文章在此） 本仓库中的所有内容都是我针对各发行版自行完成的工作： 每个内核家族都需要截然不同的原语，这正是其有趣之处。 Ghostlock 的触发完全无需特权（三个 futex、两个线程，且无需命名空间）。 将悬空指针转化为 root...

CVE-2026-23479-Redis-UAF-Proof-of-Concept

🔥 CVE-2026-23479 – Redis UAF 概念验证（PoC） RedisunblockClientOnKey 中的释放后使用（UAF）漏洞，可导致远程代码执行 附带 GDB 辅助利用的概念验证（仅限教育/实验室用途） 📖 概述 CVE-2026-23479 是 Redis 7.2.0 至 8.6.2 版本中的一个严重释放后使用（UAF）漏洞。 该漏洞位于 unblockClientOnKey 中，该函数调用了 processCommandAndResetClient，但未检查其返回值。 如果在调用过程中客户端被释放（例如因淘汰机制），调用方将继续操作悬空指针 → UAF ...

CVE-2026-7777-Rust-Use-After-Free-in-Unsafe-Web-Server

CVE-2026-7777 – Rust 不安全 Web 服务器中的释放后使用 程序代码（Rust） // uafserver.rs - Vulnerable Rust HTTP server with use-after-free use std::sync::Arc, Mutex; use std::thread; use std::io::prelude::; use std::net::TcpListener, TcpStream; struct SharedBuffer data: Vec, impl SharedBuffer fn new - Self SharedBuffe...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...

CVE-2026-98283

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

AZL-106197 CVE-2026-98218 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

DEBIAN-CVE-2026-98218

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

CVE-2026-98218

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

CVE-2026-98218

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

EUVD-2026-93211

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

EUVD-2026-93146

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

CVE-2026-98218

The Linux kernel contains a vulnerability where the function i2c_atr_add_adapter() stores a pointer to atr->adapter[chan_id] before calling i2c_add_adapter(). If i2c_add_adapter() fails, the channel is freed, but the slot remains pointing at the freed memory . This situation can result in a us...

UBUNTU-CVE-2026-104039

A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...

PT-2026-106293

A flaw was found in SSSD. A local user can cause a denial of service DoS by disrupting system authentication services. When handling Generic Security Services Application Programming Interface GSSAPI authentication in the Pluggable Authentication Module PAM responder, cached connection state is...

Linux Distros Unpatched Vulnerability : CVE-2026-98218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match chil...