CVE-2026-43499-S25U

CVE-2026-43499 PoC for Galaxy S25 Ultra Device-specific proof of concept for CVE-2026-43499 on the Korean Samsung Galaxy S25 Ultra. Supported target Model: SM-S938N Codename: pa3q Android: 16 / API 36 Build: S938NKSUACZF1 Display ID: BP4A.251205.006.S938NKSUACZF1 Fingerprint:...

ghostlock-pfem10

GhostLock — PFEM10 CVE-2026-43499 IonStack exploit for OPPO Find X5 Pro PFEM10. Kernel 5.10.236-android12-9-o, futex CMPREQUEUEPI UAF → pi-tree write primitive. Use at your own risk. Expect panics / reboots. Do not update firmware. Build ./build.sh requires Android NDK r28c Build params are fixed...

rmgp-complete-handoff

rmgp-complete-handoff Complete workspace + experiment-state backup for the CVE-2026-43499 RMGP / "popsicle" exploit targeting SM-A376B / Exynos S5E8845 / A376BXXU1AZB7. ReadCURRENTSTATE.md first — it is the authoritative "where we are" note: what works slide, skb leak, pipe oracle, 1st KernelSnit...

SUSE CVE-2026-89668

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668

CVE-2026-89668 affects the nfsd (NFS daemon) component of the Linux kernel . In init_nfsd(), nfsd_debugfs_init() is called before nfsd4_init_slabs(). If the slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphaned debugfs files with stale fops pointers into freed mod...

CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

Linux kernel uacce_put_queue uacce_fops_unl_ioctl Data Compromise

The vulnerabilities of the functions uacceputqueue and uaccefopsunlioctl in the drivers/misc/uacce/uacce.c module of the Linux kernel are related to state management errors. Exploiting these vulnerabilities can allow attackers to compromise the confidentiality, integrity, and accessibility of...

CVE-2026-64290

A flaw was found in the Linux kernel's iommufd component. When a copytouser operation fails within the iommufdfaultfopsread function, the system enters an infinite loop. This continuous retry consumes 100% of the CPU and holds a mutex, which can lead to a denial of service DoS for affected system...

CVE-2026-64290

In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufdfaultfopsread On a copytouser failure inside the inner listforeachentry, only the inner loop breaks; the outer while re-fetches the just-restored fault group and retries the failing...

CVE-2026-53188

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ibgetucaps Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd...

UBUNTU-CVE-2026-53188

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ibgetucaps Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd...

EUVD-2026-39279

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ibgetucaps Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd...

CVE-2026-53188 RDMA/core: Validate the passed in fops for ib_get_ucaps()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ibgetucaps Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd...

CVE-2026-53188

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ibgetucaps Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same devt it can masquerade as a ucap cdev fd...

PT-2026-52284

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA core where the ib get ucaps function fails to properly validate the passed-in file operations fops. Because character and block devices can share the same dev...

SUSE CVE-2026-46280

In the Linux kernel, the following vulnerability has been resolved: lib: testhmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmmtest fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special...

NVIDIA Nouveau DRI DoS

The vulnerability in the structure of nv50crcflipthresholdfops in the drivers/gpu/drm/nouveau/dispnv50/crc.c file affects the Nouveau driver that supports Direct Rendering Infrastructure DRI for NVIDIA’s Linux operating system. This vulnerability arises from improper memory release before deletin...

nouveau nouveau_pstate_fops structure DRI DoS

The vulnerability of the nouveaupstatefops structure in the drivers/gpu/drm/nouveau/nouveaudebugfs.c module – The driver that supports Direct Rendering Infrastructure DRI for NVIDIA graphics cards in the Linux operating system is vulnerable to a memory leak before the last reference is freed...

SUSE CVE-2025-21769

In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Add .owner to vmclockmiscdevfops Without the .owner field, the module can be unloaded while /dev/vmclock0 is open, leading to an oops...