EtwLeakKernel

EtwLeakKernel This repository contains a PoC for a program that utilizes ETW to leak kernel memory addresses. It does so by creating a consumer could be to almost any provider as almost all of them leak kernel addresses and requesting a stack trace from it. Once the stack trace is received, it is...

CVE-2023-2598

CVE-2023-2598 参考： https://anatomic.rip/cve-2023-2598/ https://github.com/ysanatomic/iouringLPE-CVE-2023-2598 https://bsauce.github.io/2024/07/30/CVE-2023-2598/ 构建： root@kitploit: apt install -y liburing-dev gcc CVE-2023-2598.c -o CVE-2023-2598 -luring PoC： root@kitploit: user1@syzkaller:$ uname -...

CVE-2024-26160

CVE-2024-26160 vulnerabilidad de divulgación de información en cldflt.sys Hay un pequeño análisis sobre CVE-2024-26160 , que se puede encontrar en el parche de febrero KB5034765 , Windows 11 22H2, Windows 11 23H2. La vulnerabilidad se cerró en el parche de marzo KB5035853. Análisis La...

EUVD-2026-76107

NetBSD contains an information disclosure vulnerability in mmopen within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PKKMEM process flag. Attackers can...

PT-2026-89875

NetBSD contains an information disclosure vulnerability in mm open within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK KMEM process flag. Attackers can...

CVE-2025-24990_POC

Controlador de módem Agere de Windows ltmdm64.sys. Este controlador es muy antiguo y no se carga de forma predeterminada en mi máquina de pruebas, por lo que lo explotaré en un escenario BYOVD. Curiosamente, según mi investigación, este controlador ha existido desde Windows 7 y tiene al menos un...

CVE-2023-26083

CVE-2023-26083 – Mali GPU Kernel Address Leak via Timeline Stream This repository contains a proof-of-concept PoC exploit for CVE-2023-26083 , a vulnerability in the Mali GPU driver Arm Mali GPU Kernel Driver that allows an unprivileged user to leak kernel pointers and sensitive internal...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

CVE-2026-16006

CVE-2026-16006 is an exposure of sensitive system information vulnerability in the ASUS Armoury Crate driver . A local user with low privileges can send a crafted IOCTL request that bypasses the driver's verification mechanism, allowing them to obtain kernel virtual addresses and gain insight int...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-72621

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

CVE-2026-43499-OnePlus15

CVE-2026-43499 — OnePlus 15 LPE Educational PoC WARNING: This repository is provided for educational and research purposes only. No pre-built binaries or releases are distributed. You must build everything from source. Android 16 local privilege escalation for OnePlus 15. Fork of...

Exploit for Use After Free in Linux Linux_Kernel

PS7716.5665N Hazel Fire TV temporary root Temporary root expl...

CVE-2026-80602

A flaw was found in the Linux kernel's perf subsystem. This vulnerability allows a local user to gain access to sensitive kernel memory addresses. This occurs because the system's branch stack, intended for user-only information, can inadvertently include kernel addresses, leading to an informati...

CVE-2026-80602

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2026-80602 perf/x86/amd/lbr: Fix kernel address leakage

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

CVE-2026-80602

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AM...

Linux Distros Unpatched Vulnerability : CVE-2026-80602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: dm raid: fixed the KASAN warning in raid5adddisks. There is a KASAN warning in raid5adddisk when running the LVM testsuite. The warning occurs during the test lvconvert-raid-reshape-lineartoraid6-single-type.sh. We fixed this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: BPF: Use VMMAP instead of VMALLOC for the ringbuf area. After the commit 2fd3fb0be1d1 “kasan, vmalloc: unpoison VMALLOC pages after mapping”, non-VMALLOC mappings will be marked as accessible in getvmareanode when KASAN is enable...