CVE-2022-2602

CVE-2022-2602 This repository contains exploits for CVE-2022-2602. There are two versions of it: Exploit using userfaultfd technique. Exploit using inode locking technique. Enjoy! : LukeGix...

hot-jar-swapping-urlclassloader

URLClassLoader hot jar swapping The following example code shows the ability to hot jar swap an already loaded JAR-file and get code execution by abusing the fact that inner classes still access the JAR file when invoked, as long as the inode does not change. Tested on MacOS with OpenJDK And also...

VQ-RefluxCore

VQ-RefluxCore: Kernel Vulnerability Assessment & Research Framework VQ-RefluxCore is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation LPE mechanics associated with kernel-level race conditions and filesystem structure vulnerabilities...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: dropcaches: 3 assertion...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF by restoring RCU-delayed inode freeing in bpffs Commit 4f375ade6aa9 “bpf: Avoid RCU context warning when unpinning htab with internal structs” moved inode cleanup from -freeinode to -destroyinode to prevent sleeping ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: binfmtmisc: Use exefiledenywriteaccess for the interpreter clone. For MISCFMTOPENFILE entries, loadmiscbinary clones the registered interpreter file and denies write access to the clone using plain denywriteaccess. The clone i...

CVE-2026-99137

The Linux kernel contains a vulnerability in the CIFS filesystem where the i_size is incorrectly updated in cifs_do_truncate when a cached handle is missing. Specifically, if find_writable_file() returns null, the system might set i_size to 0 even if the server-side truncation fails, leading to a...

PT-2026-128130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CIFS component where i size is updated in cifs do truncate without a cached handle. When find writable file returns null, cifs file flush returns 0 without issuing...

Linux Distros Unpatched Vulnerability : CVE-2026-98961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

kernel: procfs: avoid fetching build ID while holding VMA lock

A deadlock vulnerability was found in the procfs PROCMAPQUERY ioctl handler. When fetching the optional build ID while holding the VMA lock mmaplock, a circular lock dependency can occur with the inode mutex, causing a system deadlock...

CVE-2026-99084

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

CVE-2026-98961 btrfs: unlock inode and extent in caller when io_uring read extent fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 7.1. It stems from holding an inode lock for too long when reading from an immutable directory. Attackers can delay the getdents response via FUSE mounting, thereby blocking directory lookup, creation, and mounting operations, leading to a...

PT-2026-122044

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference leak occurs in the btrfs scrub component within the scrub print warning inode function. When the paths from inode function fails, the system jumps to an error state without...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 6.13. It arises because btrfs fails to unlock inodes and extents within the caller when an iouring read of an extent fails; similarly, it fails to unlock these resources when page array allocation returns -ENOMEM...

PT-2026-122061

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate dir takes the directory's i rwsem shared and holds it across -iterate shared. For a directory that never has an entry and is never removed the lock keeps nothing still...

PT-2026-122057

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs involving xarray nodes within the file system. This issue can be triggered using madvise. The problem is addressed by calling the xa destroy function within clear...