cve-2026-43499

GhostLock Exploitation Failure Summary on PD2229 SM8475, 5.10.233 GKI I. Vulnerability and Device Facts 1.1 CVE-2026-43499 GhostLock Basic Information Item| Value ---|--- Vulnerability Type| Stack Use-After-Free in the rtmutex / futex PI path Introduced Version| Linux 2.6.39-rc1 May 2011, commit...

UBUNTU-CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2022-0435

CVE-2022-0435 LPE PoC for CVE-2022-0435 PoC was written assuming that kaslr was disabled...

Lenovo-CVE-2025-8061

CVE-2025-8061 is a privilege escalation vulnerability in Lenovo's LnvMSRIO.sys driver. The driver exposes IOCTL handlers that allow any user-mode process including unprivileged users to: Read/write arbitrary Model-Specific Registers MSRs Read/write arbitrary physical memory This gives a standard...

CVE-2023-2598

CVE-2023-2598 Refer: https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ Build: root@kitploit: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring PoC: root@kitploit: user1@syzkaller:$...

cve-2026-43499-m3q-azf1

GhostLock SELinux park — SM-S948U1 / AZF1 m3q Research snapshot of a working SELinux-only park for Samsung Galaxy S26 Ultra SM-S948U1, codename m3q on firmware S948U1UES3AZF1 GKI 6.12.30-android16-5. This package is not a complete root. It flips SELinux to Permissive and holds reclaim long enough...

sh53d-temp-root

SH-53D temporary root This is a build-specific proof of conce...

CVE-2026-89616

A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the nireadframe function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used kernel memory pages to a local attacker who reads a specially...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

cve-2022-4543-wrapper

cve-2022-4543-wrapper Introduction This is a wrapper of willsroot's CVE-2022-4543 exploit to help you judge and get kernel base address. How to use Compile Base on your demandOptional: root@kitploit: gcc dekaslr.c --static -o dekaslr g++ main.cpp --static -o main For some OS, install static libc...

AZL-100632 CVE-2026-89616 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

DEBIAN-CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE-2026-89616

CVE-2026-89616 is an information disclosure vulnerability in the Linux kernel's NTFS3 filesystem driver. When ni_read_frame() decompresses an LZNT $DATA frame, decompress_lznt() may return fewer bytes than frame_size if the compressed stream is exhausted early. The unwritten tail region retains r...

EUVD-2026-76528

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in nireadframe nireadframe decompresses an LZNT $DATA frame into the vmapped target pages and then trusts decompresslznt's return value: uncsize = decompresslzntframeondisk,...

CVE_2026_40369

CVE202640369 Exploit poc and exp for CVE202640369, related to my analyze, use cmake. Debug code, poc and exp files for reproducing CVE202640369, written with cmake. As before, you can compile it directly using the regular cmake commands. About the analysis article: WeChat Official Account:...

prefetch-tool

Windows KASLR 预取工具 一个用于在 Windows 11 上绕过 KASLR（内核 ASLR）的概念验证工具。灵感来自针对 Linux 的 EntryBleed。 该工具是作为针对 Windows 11 24H2 的漏洞利用的一部分而开发的。我完全不是侧信道方面的专家，因此这对我来说是一个全新的领域，代码也写得非常粗糙 😳 非常欢迎帮助提高不同 CPU 类型下的可靠性。 我只用手头的机器做了有限的测试。我发现我实现的技术在现代 Intel CPU 上相当可靠，但在 AMD 上则差很多。 CPU 支持 CPU| 状态 ---|--- Intel| 🟢 可靠 AMD| 🟡 不稳...