Lucene search
+L

861 matches found

Kitploit
Kitploit
added 2026/09/13 3:32 a.m.7 views

CVE-2017-16995

CVE-2017-16995 tested for Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size...

7.8CVSS6.7AI score0.30052EPSS
SaveExploits17
RedhatCVE
RedhatCVE
added 2026/09/11 10:04 p.m.9 views

CVE-2026-89698

A flaw was found in the Linux kernel's nfsd component. When an IPv6 NFS client is connected, the nfsdgenlrpcstatuscomposemsg function incorrectly handles address fields, leading to an out-of-bounds read. A local unprivileged attacker can exploit this vulnerability to disclose sensitive kernel...

6.5CVSS0.00198EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/11 8:19 p.m.5 views

CVE-2026-80952

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

7.8CVSS0.00125EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/11 7:42 p.m.9 views

EUVD-2026-76275

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

0.00125EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/11 7:42 p.m.10 views

CVE-2026-80952

CVE-2026-80952 affects the Linux kernel i3c master component. The root cause is a race condition in i3c_master_unregister_i3c_devs(), which clears the device descriptor (i3cdev->dev->desc) before device_unregister() completes. During the unbind process, i3c_device_uevent() and a racing moda...

7.8CVSS0.00125EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/11 7:42 p.m.25 views

CVE-2026-80952 i3c: master: Fix info leak and UAF in device unregister path

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3cmasterunregisteri3cdevs clears i3cdev-dev-desc before calling deviceunregister. During deviceunregister, devicedel emits a KOBJREMOVE uevent and unbinds the driver...

7.8CVSS0.00125EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/11 7:42 p.m.14 views

CVE-2026-80944

CVE-2026-80944 affects the Linux kernel's mwifiex Wi-Fi driver. Synchronous commands store a caller-provided data buffer in cmd_node->data_buf; several callers pass stack-allocated objects. If wait_event_interruptible_timeout() is interrupted, the caller releases the stack object while the fir...

7.8CVSS0.00128EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/09/11 12:00 a.m.8 views

PT-2026-90082

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3c master unregister i3c devs clears i3cdev-dev-desc before calling device unregister. During device unregister, device del emits a KOBJ REMOVE uevent and unbinds the...

0.00125EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/08 9:36 p.m.7 views

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

7.8CVSS7.4AI score0.00789EPSS
SaveExploits90References1
Kitploit
Kitploit
added 2026/09/08 2:47 p.m.10 views

K50G-POCOF4GT-CVE-2026-43499-PoC

Redmi K50 Gaming ingres — CVE-2026-43499 GhostLock 临时 Root PoC 免解锁 BL 一键临时 Root 。利用 GhostLock(CVE-2026-43499, futex PI Use-After-Free) 本地提权链拿到 root 锚点,随后通过 KernelSU 3.3.0 late-load 方式把 kernelsu 模块挂载进运行中的内核,配合 KSU 模块保持 SELinux Permissive 并修复网络。 目标设备: Redmi K50G / POCO F4 GT —— 代号 ingres, SoC SM845...

7.8CVSS7.4AI score0.00789EPSS
SaveExploits90
Kitploit
Kitploit
added 2026/09/07 5:51 p.m.6 views

setcred

FreeBSD setcred2 — research artifacts This subdirectory collects the write-up and working exploits for the setcred2 stack buffer overflow in FreeBSD 14.x kernel. The vulnerability itself is fully documented in setcred.txt. The short version: kernsetcredcopyinsuppgroups uses sizeofgroups where...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/06 7:32 p.m.11 views

CVE-2017-7184

CVE-2017-7184 – Linux Kernel XFRM Privilege Escalation No Sudo Overview This repository contains a proof-of-concept local privilege escalation exploit for CVE-2017-7184 , a Linux kernel vulnerability in the XFRM IPsec netlink subsystem. The exploit demonstrates how an unprivileged user can gain...

7.8CVSS6.9AI score0.01798EPSS
SaveExploits4
SUSE CVE
SUSE CVE
added 2026/09/05 12:28 a.m.10 views

SUSE CVE-2026-80761

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

5.8AI score0.00168EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/04 4:18 p.m.3 views

AZL-99594 CVE-2026-80761 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

5.8AI score0.00168EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/04 3:12 p.m.13 views

CVE-2026-80761 Bluetooth: ISO: zero the sockaddr before returning it in getname

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

5.7AI score
SaveExploits0References7
CVE
CVE
added 2026/09/04 3:12 p.m.14 views

CVE-2026-80761

CVE-2026-80761 is a kernel information disclosure in the Linux kernel's Bluetooth ISO (Isochronous) socket subsystem. The function iso_sock_getname() populates a struct sockaddr_iso without first clearing it, causing uninitialized kernel stack bytes to be copied to user space via getsockname(2) o...

5.4AI score0.00168EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/04 3:12 p.m.6 views

EUVD-2026-71404

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kern...

5.4AI score0.00168EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/09/04 12:00 a.m.5 views

Linux Distros Unpatched Vulnerability : CVE-2026-80761

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: zero the sockaddr before returning it in getname isosockgetname fills a struct sockaddriso in place and returns its size without clearing it...

6.1AI score0.00168EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/08/28 4:34 p.m.8 views

SUSE CVE-2026-80662

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

7.1CVSS6AI score0.00124EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/28 8:16 a.m.11 views

AZL-98096 CVE-2026-80662 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix CXLHEADERLOGSIZE to match RAS Capability size The CXL r4.0 8.2.4.17.7 RAS Capability Structure has total length 0x58 bytes CXLRASCAPABILITYLENGTH; the Header Log occupies the trailing 64 bytes at offset 0x18...

7.1CVSS6AI score0.00124EPSS
SaveExploits0References1
Rows per page
Query Builder