cve-2026-23398-poc

Lab: CVE-2026-23398 ICMP / ipnopmtudisc=3 Reproducible lab for the Linux kernel bug in icmptagvalidation NULL dereference when net.ipv4.ipnopmtudisc = 3 and a Fragmentation Needed ICMP arrives whose quoted inner IPv4 header uses a protocol number with no handler in inetprotos. Authorized use only...

CVE-2026-99168

A flaw was found in the Linux kernel's Microsoft Hyper-V Virtual Trust Level mshvvtl driver. When setting up per-processor register pages, an allocation failure on one CPU leaves its page pointer uninitialized while a global flag is set by another CPU. A local user can exploit this issue by...

CVE-2026-99015

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS by crashing the system. Due to missing lock synchronization when rebinding a Host Controller Interface HCI socket after a controller is unregistered, a race conditio...

CVE-2026-99093

A flaw was found in the Linux kernel. A privileged user capable of modifying boot parameters can cause a Denial of Service DoS by enabling early boot function tracing. Under this configuration, the kernel attempts to schedule deferred page table memory cleanup before necessary internal work...

CVE-2026-99199

A flaw was found in the Linux kernel's HiSilicon hip04 Ethernet driver. A local attacker can cause a Denial of Service DoS by triggering device probing under specific network shaping configurations. Due to an improper initialization order, the driver accesses internal network device operations...

CVE-2026-99041

A flaw was found in the Linux kernel. A local user can trigger a null-pointer dereference in the IPv6 Encapsulated Remote Switch Port Analyzer ERSPAN networking module by redirecting traffic with attached tunnel metadata to an ERSPAN device. This flaw leads to a kernel panic, resulting in a syste...

CVE-2026-99008

A flaw was found in the Linux kernel's Bluetooth subsystem. When an RFCOMM Radio Frequency Communication terminal device fails to register properly during initialization, closing the device triggers a null pointer dereference in the shutdown handler. A local attacker could exploit this...

CVE-2026-99209

A flaw was found in the Linux kernel's drm/xe graphics driver. A local user could exploit this vulnerability to cause a Denial of Service DoS via a kernel crash. The issue occurs when evicting a graphics buffer object that lacks an assigned memory resource, causing the driver to dereference a NUL...

CVE-2026-99197

A flaw was found in the Linux kernel's Marvell mv643xx Ethernet driver. This flaw can result in a Denial of Service DoS by causing the system to crash during device initialization. The issue occurs because the driver attempts to attach the physical network interface before assigning its internal...

CVE-2026-99003

A flaw was found in the Linux kernel's Panthor Direct Rendering Manager DRM driver. When the hardware firmware initializes fewer queue slots than the driver's hardcoded maximum, the driver fails to properly validate the requested queue count against the actual initialized firmware slots. A local...

CVE-2026-99175

A flaw was found in the Linux kernel. A race condition in the filesystem notification fsnotify subsystem allows mark additions to occur during connector teardown. A local unprivileged user can exploit this race by modifying inotify watches while reading file descriptor information, triggering a...

CVE-2026-99198

A flaw was found in the Linux kernel's Actions Semi Owl Ethernet driver. When initializing or probing the network device with network traffic shaping enabled, the driver attempts to access network device operations before they are assigned. A local user capable of attaching or probing the device...

CVE-2026-99200

A flaw was found in the Linux kernel's HiSilicon Fast Ethernet MAC hisifemac network driver. This flaw can result in a Denial of Service DoS due to a system crash during device probing. When initializing the network interface, the driver attempts to access network device operations before they ar...

CVE-2026-99176

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM nested virtualization component. When loading nested virtual machine state fails during certain non-standard entry operations, KVM fails to reset the memory management unit MMU pointer back to the root context. A local user...

CVE-2026-99179

A flaw was found in the Linux kernel's watch queue subsystem, which can lead to a Denial of Service DoS. A race condition exists between queue resizing and notification delivery due to improper memory access ordering. A local, unprivileged user could exploit this flaw by concurrently resizing a...

CVE-2026-117548

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN rename operation uses an attribute's schema alias name such as "commonName" instead of its canonical name such as "cn" as the new relative distinguished name. An authenticated attacker with the ModifyDN...

CVE-2021-24086-exp

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 "Windows TCP/IP Denial of Service Vulnerability ", a NULL dereference in tcpip.sys patched by Microsoft in February 2021. According to this tweet, the vulnerability has been found by @piazzt. It is triggerable remotely by sending...

CVE-2026-117548

A NULL pointer dereference flaw exists in 389-ds-base . The issue is triggered during a ModifyDN (rename) operation when the operation utilizes an attribute's schema alias name (e.g., "commonName") instead of its canonical name (e.g., "cn") as the new relative distinguished name. An authenticated...

CVE-2026-117548 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN rename operation uses an attribute's schema alias name such as "commonName" instead of its canonical name such as "cn" as the new relative distinguished name. An authenticated attacker with the ModifyDN...

EUVD-2026-112637

A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN rename operation uses an attribute's schema alias name such as "commonName" instead of its canonical name such as "cn" as the new relative distinguished name. An authenticated attacker with the ModifyDN...