Oracle Linux 8 : kernel (ELSA-2026-75747)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-75747 advisory. - nvme/ioctl: check SUBMITIO with CAPSYSADMIN Chris Leech RHEL-269479 CVE-2026-90227 - nvme-pci: fix mempool alloc size Maurizio Lombardi RHEL-230386...

cormem-read-poc

DISCLAIMER : This project is for educational and security research purposes only. Use only on systems you own or have explicit permission to test. Unauthorized use may be illegal in your jurisdiction. cordrvexploit — CVE-2026-38194 Vulnerability This tool demonstrates CVE-2026-38194, a...

CVE-2026-14960-CVE-2026-14961

Privilege Escalation Vulnerabilities in Pegatron TdeIo64 Driver tdeio64.sys | ---|--- CVE IDs| CVE-2026-14960, CVE-2026-14961 Vendor| Pegatron Corporation Product| TdeIo Driver tdeio64.sys Device Interface| \.\TdeIo Vulnerability Types| Improper Access Control CWE-284, Arbitrary Kernel Memory...

CVE-2026-46215-POC

CVE-2026-46215: DRM GEM changehandle Use-After-Free unprivileged LPE Local privilege escalation via a use-after-free in the DRM core ioctl DRMIOCTLGEMCHANGEHANDLE drmgemchangehandleioctl, ioctl nr 0xD2. Reachable by any user with access to a render node /dev/dri/renderD, granted to the active...

0xM0nCrush

0xM0nCrush Кроссплатформенный для разных версий Windows завершитель процессов. Он загружает подписанный драйвер ядра HONOR MonProcessEX.sys, определяет PID каждого целевого процесса и завершает его из контекста ядра через один IOCTL. Никаких смещений ядра, никаких загрузок PDB, никакого shellcode...

CVE-2025-7771-Vulnerability-Exploration

🔓 ThrottleStop.sys Kernel Exploit — HVCI-Compatible Physical Memory Mapper CVE-2025-7771 — Arbitrary Physical Memory Read/Write via ThrottleStop.sys IOCTLs ⚠️ Disclaimer This project is published for educational and research purposes only. The goal is to demonstrate how a signed, trusted kernel...

throttlestop-exploit-rw

Physical Memory Mapper Research tool demonstrating physical memory access through virtual-to-physical address translation combined with vulnerable driver exploitation. Overview This project explores low-level Windows memory management by combining the superfetch technique for address translation...

CVE-2021-29337

CVE-2021-29337 - Privilege Escalation in MODAPI.sys MSI Dragon Center General Affected Product: MSI Dragon Center Affected Version: 2.0.104.0 CVE MITRE Description A vulnerable kernel driver MODAPI.sys in dragon center exposes IOCTL 0x9C406104 which allows low-privileged users to interact directl...

Terminator_Killer

Terminator - Red Team Process Killer A kernel-mode process termination tool leveraging a vulnerable driver CVE-2026-0828 to kill protected processes from user mode. Compilation Requires MinGW-w64 GCC on Windows. Compile with: g++ --% .\terminator.cpp -o terminator.exe -Oz -ffunction-sections...

CVE-2018-7273

include include include include include include include include include include static int driveselectorint head return head 2; void fdrecalibrateint fd struct floppyrawcmd rawcmd; int tmp; rawcmd.flags = FDRAWINTR; rawcmd.cmdcount = 2; // set up the command rawcmd.cmdrawcmd.cmdcount++ = 0x07;...

CVE-2020-14974

CVE-2020-14974 A simple POC that demonstrates A vulnerability found in IObitUnlocker 1.1.2 that leverages IOCTL codes found it its vulnerable driver IObitUnlocker.sys, providing ability to unlock, delete, rename, copy, and move running files as a low privileged user. Resources...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...

dtrace-memaccess_cve-2020-27949

Reading and writing memory of other processes using fasttrap The /dev/fasttrap device for creating trap nodes in user-space processes for the pid and objc providers has the permissions 666. In contrast to /dev/dtrace, which is also 666, fasttrap lacks a permission check. This allows any process t...

CVE-2021-42205

CVE-2021-42205 ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice. authentication| complexity| vector ---|---|--- not...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Произвольное чтение/запись физической памяти и портов ввода-вывода через драйвер ThrottleStop ThrottleStop — это небольшое легитимное приложение, используемое для мониторинга и исправления троттлинга процессора. Оно имеет драйвер, который выполняет эти задачи и в...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevents potential Spectre v1 exploits. It seems that cmd could be a Spectre v1 exploit, as it is provided by a user and used as an array index. This vulnerability prevents the contents of kernel memory from being leake...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: arkfb: Fixed a divide-by-zero bug in arksetpixclock Since the user can control the arguments of the ioctl function from the user space, there are special cases where a divide-by-zero bug may occur. For example, in:...

WiseDelete

WiseDelfile Driver Wrapper A lightweight Windows utility that loads the WiseDelfile64.sys kernel driver, performs the required device handshake, and issues IOCTL requests to delete files that cannot be removed through standard Windows APIs. This project demonstrates how CVE-2025-66680 , can be us...

cve-2026-0828

CVE-2026-0828 — Safetica ProcessMonitorDriver.sys BYOVD PoC Safetica DLP kernel driver ProcessMonitorDriver.sys exposes an unauthenticated IOCTL that allows any user-mode caller to terminate arbitrary processes via ZwTerminateProcess in kernel context, bypassing PPL Protected Process Light...

kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express input/output control ioctl handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the NVMEIOCTLSUBMITIO function. This allows them to perform unauthorized I/O operations on a...