swapgs-attack-poc

PoC for the SWAPGS attack CVE-2019-1125 This repository holds the sources for the SWAPGS attack PoC publicly shown at Black Hat USA, 2019. Contents leakgsbkva - variant 1 look for random values in kernel memory; limited to PE kernel image header leakgsbkvat - variant 2 extract random values from...

meltdown-exploit

MELTDOWN エクスプロイト PoC 投機的実行最適化は、安全でない方法でコードを実行し、キャッシュなどのマイクロアーキテクチャにデータの痕跡を残します。 Lipp 他 2018 は 2018-01-09 にコードを https://github.com/IAIK/meltdown で公開しました。詳細は論文 https://meltdownattack.com/meltdown.pdf を参照してください。 現時点では linuxprocbanner のみダンプ可能です。アクセスするメモリがキャッシュにある必要があり、/proc/version から読み取るたびに...

CVE-2022-1015

CVE-2022-1015 root@kitploit: id uid=1000d gid=1000d groups=1000d ./poc + unshare done table created: leaktable chain created: leakchain rule added Listening on port 9999 table created: leaktable chain created: leakchain rule added Listening on port 9999 kerneladdress: ffffffffb4a00000 kernelstack...

Linux Distros Unpatched Vulnerability : CVE-2026-89674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in nfsd4ffencodelayoutget has multiple errors that can result in eith...

Linux Distros Unpatched Vulnerability : CVE-2026-89621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts...

CVE-2026-89628

A flaw was found in the Human Interface Device HID picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in the picolcddebugeepromread function. This flaw occurs because...

CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

AZL-100644 CVE-2026-89621 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89714 NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

In the Linux kernel, the following vulnerability has been resolved: NFS: fix delegationhashtable leak when nfs4servercommonsetup fails nfs4servercommonsetup allocates server-delegationhashtable first, but server-destroy - the only path that frees the table via nfs4destroyserver - is not assigned...

EUVD-2026-76533

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221rawevent mcp2221rawevent never validates the size of incoming HID reports. In the MCP2221I2CGETDATA path it trusts the device-supplied data3 as the copy length without checking that 4 ...

CVE-2026-89583

CVE-2026-89583 is an out-of-bounds (OOB) read in the Linux kernel's Bluetooth EIR parser, specifically in eir_get_service_data(). The root cause is an incorrect length calculation: when walking Extended Inquiry Response advertising data, the eir_len variable is decremented by only the data length...

CVE-2026-15710

CVE-2026-15710 affects the Endpoint DLP kernel driver (epdlpdrv.sys) of Netskope Client for Windows prior to version R141 . Two root causes enable the information leak: (1) the internal communication channel between the user-space hook DLL, the kernel driver, and the daemon lacked token-based mes...

kernel: smb/client: fix out-of-bounds read in smb2_compound_op()

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...

Linux Distros Unpatched Vulnerability : CVE-2026-80543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Pad trailing CCA or EP11 message with zeros The both functions...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098937)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098937 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race iioeventgetfd creates the event file descriptor with...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...

CVE-2026-9728 TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory

The userspace syscall verifier zvrfymboxsend in drivers/mbox/mboxhandlers.c validated the nested msg-data/msg-size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mboxmsg pointer to zimplmboxsend and the underlying...