CVE-2026-98197

A flaw was found in the Linux kernel's w83791d hardware monitoring driver. This vulnerability allows a local user to cause a Denial of Service DoS by triggering a kernel crash. During driver removal, the driver fails to unregister optional sysfs interface files, leaving them accessible after the...

CVE-2021-30955-POC

CVE-2021-30955 POC Proof of concept wrapped into an iOS app for CVE-2021-30955 All credit to Jake James. His POC code used in this project can be found here. What is this? This demonstrates CVE-2021-30955, an iOS bug which allows an app in userspace to gain kernel-level permissions. In order to...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

CVE-2026-98178

A flaw was found in the Linux kernel's AMD GPU driver. When compute subsystem initialization fails, uninitialized device structures remain attached to the graphics driver. A local user capable of triggering a GPU reset can cause the system to dereference an unallocated memory pointer, resulting i...

CVE-2026-98371

A flaw was found in the Linux kernel's IP Traffic Flow Security IP-TFS subsystem. Incomplete length validation when reassembling fragmented inner packets allows undersized packets to trigger an internal calculation underflow. A local user or remote attacker could exploit this vulnerability by...

CVE-2018-4407

CVE-2018-4407 Bloqueo del kernel causado por escritura fuera de los límites en el código de manejo de paquetes ICMP de Apple CVE-2018-4407 para iOS 11.0，11.2，11.3.1...

cve-2022-21907

CVE-2022-21907 Aplicación Golang por 1vere$k CVE-2022-21907 - Double Free en el controlador http.sys. Resumen Esta es una aplicación Golang de subprocesos múltiples que permite hacer solicitudes a algunos objetivos simultáneamente. No es muy productiva con las solicitudes POST, pero proporciona...

check_icmp_dos-CVE-2018-4407-

Principio El principio consiste en hacer que otros campos del paquete "icmp" sean inválidos; cuando el kernel de macOS o iPhone los analiza, no se ha implementado la comprobación de tamaño, lo que provoca un crash. Dispositivos 1. Apple iOS 11 y versiones anteriores: todos los dispositivos 2. App...

CVE-2022-34715-POC

CVE-2022-34715-POC CVE-2022-34715-POC pcap nfssvr.sys versión 10.0.20348.825 0: kd r rax=0000000080000001 rbx=0000000000000000 rcx=ffffde87fe461150 rdx=0000000000000000 rsi=fffff8040811aa50 rdi=0000000000000008 rip=fffff80408067dbb rsp=ffffb400eb3e2630 rbp=ffffb400eb3e26b9 r8=0000001000000020...

CVE-2022-21907-http.sys

CVE-2022-21907 - Doble liberación en el controlador http.sys CVE-2022-21907 - Doble liberación en el controlador http.sys Resumen Un atacante no autenticado puede enviar una solicitud HTTP con una cabecera de solicitud HTTP "Accept-Encoding" que desencadena una doble liberación en la lista de...

CVE-2019-2215

CVE-2019-2215 El siguiente problema existe en la rama android-msm-wahoo-4.4-pie de https://android.googlesource.com/kernel/msm y posiblemente en otras: Hay un use-after-free del miembro wait en la estructura binderthread del controlador binder en /drivers/android/binder.c. Como se describe en la...

CVE-2025-62470

Esto no es una explotación, solo una POC BUGCHECKCODE: 50 BUGCHECKP1: ffffc101f6bf91be BUGCHECKP2: 0 BUGCHECKP3: fffff8007e194409 BUGCHECKP4: 0 READADDRESS: ffffc101f6bf91be MMINTERNALCODE: 0 IMAGENAME: CLFS.SYS MODULENAME: CLFS FAULTINGMODULE: fffff8007e190000 CLFS PROCESSNAME:...

CVE-2018-4407

CVE-2018-4407 Caída del kernel de IOS/macOS Uso: python CVE20184407.py IP/CIDR python CVE20184407.py 192.168.1.1 python CVE20184407.py 192.168.1.0/24 1. encontrar iPhone nmap -sS -p 62078 --open 192.168.1.0/24 2. atacar python CVE20184407.py iphoneip...

CVE-2026-98358

A flaw was found in the Linux kernel's iSCSI Extensions for Remote Direct Memory Access iSER driver. A remote storage target can trigger a Denial of Service DoS by sending an unexpected remote invalidation response for write operations transmitted as immediate data. In this scenario, the initiato...

CVE-2026-98268

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent...

CVE-2026-98268 perf: Fix null pointer access in is_include_guest_event()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent...

kernel: gfs2: Fix unlikely race in gdlm_put_lock

A flaw was found in the Linux kernel’s Global File System 2 implementation affecting distributed lock manager DLM handling in the gdlmputlock function. During an unmount operation, if the DFLUNMOUNT flag is set but the lockspace has not yet been fully released, remote callbacks gdlmast or gdlmbas...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - ice: xsk: disabling TXQ interrupts before flushing hardware settings. - iceqpdis attempts to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps involved disabling interrupts on these queues...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm-verity: properly handling failures of dmbufioclientcreate If either of the calls to dmbufioclientcreate in verityfecctr fails, then dmbufioclientdestroy is called later with an ERRPTR argument. This causes a crash. Fix this...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: slip: Reject VJ receive packets on instances with no rstate array. slhcinit accepts rslots == 0 as a valid configuration, which means “no receive compression”. In that case, the allocation loop in slhcinit is skipped, so...