CVE-2026-99999-exploit

CVE-2026-99999 — PoC Exploit Repository ⚠️ This is a working exploit repository. It contains real exploit code that triggers the CVE-2026-99999 vulnerability in a live KVM/QEMU environment. 📚 For a safe, local-only simulation of the same attack chain, see CVE-2026-99999-analysis no root, no...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in buildxattrs buildxattrs decodes the MDS-supplied xattr blob one attribute at a time. For each attribute, it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length,...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fillmax is set When a USB audio endpoint requests full packet transfers via the fillmax descriptor flag, dataepsetparams promotes ep-curpacksize to ep-maxpacksize. However,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-89859

A flaw was found in the qla2xxx SCSI driver within the Linux kernel. The qla2x00dodportdiagnostics function allocates a diagnostics buffer without initializing all its fields. When this buffer is copied to user space, the uninitialized options and unused fields can leak sensitive kernel heap memo...

CVE-2026-15466

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466 GPU DDK - Write UAF due to a race condition caused by insufficient locking in PVRSRVRGXCloseHWPerfClientStreamKM()

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

EUVD-2026-113474

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466

Imagination Technologies Graphics DDK (versions 24.2 RTM2, 25.1 RTM2 through 25.3 RTM, and 26.1 RTM2) contains a resource management error. A non-privileged user can perform improper GPU system calls to trigger a race condition in the destruction path of hardware performance counters buffers. Thi...

PT-2026-133258

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

CVE-2026-15466: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause race condition in hardware performance counters buffer’s destruction path leading to read and/or write UAF. The race condition in the destruction path could lead to reference counter being decrement...

SUSE CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-98668

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem. This vulnerability allows information disclosure when the kernel processes unaligned data buffers with timestamps enabled. Because the allocated buffer is not properly cleared before being shared with user space, a local user ca...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ibmasm: Fix OOB reads in commandfilewrite due to missing size checks The commandfilewrite handler allocates a kernel buffer of exactly count bytes and copies user data into it; however, it fails to validate the buffer against the...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability that stems from the lack of strict validation for the length of the SEG6ATTRDST attribute. This allows shorter payloads, resulting in out-of-bound reads of 16-byte segments of uninitialized kernel heap memory. This vulnerability can be exploited throu...

SUSE CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

DEBIAN-CVE-2026-98236

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

AZL-106221 CVE-2026-98236 affecting package kernel for versions less than 6.6.158.1-1

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...