CVE-2026-97474

A flaw was found in the Linux kernel's Intel Wi-Fi driver iwlwifi. This vulnerability can lead to a Denial of Service DoS when a wireless network interface encounters a firmware error during connection reconfiguration. Because the driver fails to immediately discard pending asynchronous...

CVE-2026-28992-IOHIDFamily-FastPathUserClient-Race-Conditions

CVE-2026-28992: IOHIDFamily FastPathUserClient Race Conditions CVE-2026-28992 | Author: Johnny Franks @zeroxjf Component: IOHIDFamily Impact: An attacker may be able to cause unexpected app termination Description: A memory corruption vulnerability was addressed with improved locking. —Apple...

CVE-2026-97441

A flaw was found in the Linux kernel's Advanced Host Controller Interface AHCI driver. When a storage controller reports more ports than can fit within its allocated Base Address Register BAR memory space, the driver attempts to access registers beyond the mapped boundary. A local attacker or...

CVE-2024-27815

CVE-2024-27815 Desbordamiento de búfer en el heap del kernel de XNU en sbconcatmbufs bsd/kern/uipcsocket2.c, alcanzable por un usuario local sin privilegios a través de la capa de sockets de datagramas AFUNIX. Una dirección de socket de hasta SOCKMAXADDRLEN 255 bytes se copia en un área de datos ...

flow_divert-heap-overflow

flowdivert-heap-overflow flowdivert-heap-overflow es un exploit de prueba de concepto para CVE-2016-1827, que fue parcheado en OS X El Capitan 10.11.5 e iOS 9.3.2. La vulnerabilidad consiste en una serie de operaciones aritméticas sin comprobar sobre una longitud no confiable suministrada desde e...

GenEtherExploit

ES GenEtherExploit es un exploit de prueba de concepto PoC para la vulnerabilidad de macOS CVE-2023-40404. Este PoC utiliza las APIs de IOKit para interactuar con el servicio de red IOUserEthernetResource, manipulando las interfaces de red del sistema. El propósito de este exploit es demostrar un...

CVE-2026-43499-PoC-Scanner

Escáner PoC CVE-2026-43499 Este repositorio contiene un escáner basado en Go y una implementación de prueba de concepto para una vulnerabilidad del kernel de Linux relacionada con CVE-2026-43499. El proyecto está destinado únicamente a investigación, análisis defensivo y pruebas de seguridad...

sysctl_coalition_get_pid_list-dos

sysctlcoalitiongetpidlist 拒绝服务 bsd/kern/syscoalition.c 中的 sysctlcoalitiongetpidlist 函数使用 coalitiongetpidlist 函数收集一个联盟中的 PID 列表。该函数在成功时返回 PID 数量，失败时返回负的 errno。然而，sysctlcoalitiongetpidlist 函数没有正确检查错误条件，这意味着它会尝试通过 SYSCTLOUT 向用户空间发送负数个 PID。由于长度参数是 sizet 类型，最终导致调用 copyout 时传入一个非常大的值。...

Exploit for Missing Authentication for Critical Function in Qualcomm Ar9380_Firmware

Poco M7 Plus SM6375 — Temporary Root Research: Qualcomm G...

CVE-2017-2671

Vulnerabilidad de denegación de servicio local en el kernel de Linux CVE-2017-2671 qué !! CVE-2017-2671 1 Denegación de servicio local en el kernel de Linux CVE-2017-2671 en consecuencia, no puede garantizar que las llamadas a la función disconnect sean seguras, lo que permite a los usuarios...

ScreenOff

ScreenOff PoC de caída del kernel CVE-2026-52910. ref: https://github.com/5unkn0wn/security-research/tree/CVE-2026-52910ltscosmitigation qué Condición de carrera entre socket + SOATTACHREUSEPORTCBPF + setsockopt. La tormenta de callbacks de timerfd/epoll ralentiza la ruta de recepción. Reemplaza...

CVE-2025-29338

CVE-2025-29338 — Aviso de Seguridad Desbordamiento de Búfer en la Pila en el Controlador Wi-Fi del Kernel NXP moal.ko woalsetupmoduleparam / parsecfggetline Campo| Valor ---|--- ID CVE| CVE-2025-29338 Gravedad| Alta Puntaje CVSS v3.1| 7.8 Vector CVSS v3.1|...

CVE-2022-36946

CVE-2022-36946 报告人：Domingo Dirutigliano 和 Nicola Guerrera 当我们在开发 firegex（我们为 CTF 攻防竞赛开发的应用程序防火墙）时，偶然发现了几次内核崩溃。 这个奇怪的行为随后被隔离和分析，最终发现了 netfilter 模块中（特别是 nfnetlink）的这一个潜在安全缺陷。 它是如何工作的？ 当发送带有 0 字节 nftapayload 属性的 nfqueue 裁决时，内核会发生崩溃。 nlh = nfqnlmsgputbuf, NFQNLMSGVERDICT, queuenum;...

kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem, specifically within the rxe component. This vulnerability arises from an incorrect conversion of I/O Virtual Addresses iova to Virtual Addresses va when Memory Regions MRs have page sizes that differ from the...

CVE-2026-98007

A flaw was found in the Linux kernel. A privileged local user can cause a Denial of Service DoS by loading a specially crafted BPF Berkeley Packet Filter program that passes a pointer value instead of a scalar number as the loop iteration count to the bpfloop function. Because the kernel's BPF...

CVE-2026-97526

A flaw was found in the Linux kernel's s390 Processor Activity Instrumentation PAI performance monitoring unit. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the operating system. When a CPU is dynamically added hotplugged during an active performance...

kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

A flaw was found in the vmxnet3 virtual network device driver within the Linux kernel. When processing Geneve-encapsulated packets, the vmxnet3gethdrlen function can incorrectly interpret header information, leading to a mismatch between expected and actual packet protocols or IP versions. This c...

CVE-2026-43499

CVE-2026-43499 — Uso después de liberar en Futex PI del kernel de Linux Fallo removewaiter en kernel/locking/rtmutex.c es utilizado por las rutas de slowlock, pero también para el rollback de proxy-lock en rtmutexstartproxylock cuando se invoca desde futexrequeue. En el caso de proxy-lock,...

CVE-2026-98146

A flaw was found in the Linux kernel's AMD XDNA driver, which can result in a Denial of Service DoS. The driver processes command chains located in shared memory that can be concurrently modified by userspace. By altering the command counter during execution, a local attacker can cause a bounds...

CVE-2024-27804

CVE-2024-27804 ./build.sh ./panic.sh paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3: 0xfffffe3a396e3444 x4: 0xfffffe3a396e344...