CVE-2025-38352-PoC

CVE-2025-38352: Linux Kernel POSIX CPU Timer TOCTOU Race Condition & UAF A reproducible Proof-of-Concept PoC and automated GDB orchestration script for CVE-2025-38352 , a Time-of-Check to Time-of-Use TOCTOU race condition in the Linux kernel's POSIX CPU timer subsystem...

check_icmp_dos-CVE-2018-4407-

Principle The principle is to make other fields of the 'icmp' packet illegal. When the macOS or iPhone kernel parses it, it does not implement size checking, causing a crash. Affected Devices 1. Apple iOS 11 and earlier: all devices 2. Apple macOS High Sierra highest affected version 10.13.6: all...

CVE-2021-30955-POC

CVE-2021-30955 POC Proof of concept wrapped into an iOS app for CVE-2021-30955 All credit to Jake James. His POC code used in this project can be found here. What is this? This demonstrates CVE-2021-30955, an iOS bug which allows an app in userspace to gain kernel-level permissions. In order to...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

CVE-2019-2215

CVE-2019-2215 The following issue exists in the android-msm-wahoo-4.4-pie branch of https://android.googlesource.com/kernel/msm and possibly others: There is a use-after-free of the wait member in the binderthread struct in the binder driver at /drivers/android/binder.c. As described in the...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

CVE-2026-98932

A flaw was found in the Linux kernel's Altera EDAC Error Detection and Correction driver. In device setup error-handling paths, driver memory is released before the associated interrupt handlers are unregistered. If an interrupt fires during this cleanup window, the handler dereferences freed...

CVE-2026-98930

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for the s390 architecture. A local user with access to the KVM interface can trigger a Denial of Service DoS by injecting a stop and store status signal into an already stopped virtual CPU vCPU. In this scenario, th...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys version 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

CVE-2018-4407

CVE-2018-4407 IOS/macOS kernel crash Usage: python CVE20184407.py IP/CIDR python CVE-20184407.py 192.168.1.1 python CVE20184407.py 192.168.1.0/24 1. find iphone nmap -sS -p 62078 --open 192.168.1.0/24 2. attack python CVE20184407.py iphoneip...

CVE-2018-4407

CVE-2018-4407 Kernel crash caused by out-of-bounds write in Apple's ICMP packet-handling code CVE-2018-4407 for iOS 11.0，11.2，11.3.1...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

CVE-2026-99141

A flaw was found in the Linux kernel's tracing subsystem. This vulnerability allows a local user with access to tracing controls to cause a Denial of Service DoS by triggering a kernel crash. When switching tracers, the kernel leaves trace flags unassigned if the new tracer lacks default flags. I...

CVE-2025-62470

This is not exploiting, just POC BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME: ConsoleApplication4.exe...

CVE-2026-99133

A flaw was found in the Linux kernel's IUCV Inter-User Communication Vehicle networking subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS through a kernel crash or unexpected socket disconnection. The vulnerability is triggered when processing message receive...

CVE-2026-90013

A flaw was found in the Linux kernel's tracing subsystem. When an options file is opened, it fails to properly manage references to the associated trace array. This oversight allows a local attacker to trigger a use-after-free condition by removing the trace array instance while the options file ...

CVE-2026-99125

A flaw was found in the Linux kernel's s390 Processor Activity Instrumentation PAI performance monitoring subsystem. A local user can trigger a Denial of Service DoS by generating heavy sampling workloads or manipulating event controls, causing the kernel to improperly handle consecutive stop...

CVE-2026-99103

A flaw was found in the Linux kernel's workqueue subsystem. A use-after-free vulnerability can occur when canceling inactive work items, as an internal worker pool structure is freed while still referenced on a pending queue. A local user could trigger this condition during workqueue operations,...

CVE-2026-99173

A flaw was found in the Linux kernel's eventfs subsystem. An improper synchronization issue allows an internal directory structure eventfsinode to be freed while still being accessed during file path validation, leading to a use-after-free condition. A local user could exploit this vulnerability...

CVE-2026-99004

A flaw was found in the Imagination Technologies GPU driver drm/imagination in the Linux kernel. An integer underflow in the driver's page table calculation can lead to a Denial of Service DoS. A local user can exploit this vulnerability when requesting memory mappings that cross page table...