CVE-2026-119086

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privilege...

EUVD-2026-114246

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privilege...

CVE-2017-16995

CVE-2017-16995 tested for Ubuntu 16.04.01 - Linux 4.4.0-31-generic 50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x8664 This vulnerability allow a simple user to do a privilege escalation and get a root shell if different kernel adjust CRED offset + check kernel stack size...

K50G-POCOF4GT-CVE-2026-43499-PoC

Redmi K50 Gaming ingres — CVE-2026-43499 GhostLock Temporary Root PoC One-click temporary Root without unlocking BL. Uses the GhostLock CVE-2026-43499, futex PI Use-After-Free local privilege escalation chain to obtain a root anchor, then mounts the kernelsu module into the running kernel via...

CVE-2026-98914

A flaw was found in the Linux kernel's amdgpu graphics driver. The driver fails to limit the nesting depth during the execution of ATOM command tables, allowing unbounded recursion. A local user could trigger excessive recursion to cause a kernel stack overflow, leading to a system crash and Deni...

CVE-2026-98917

A flaw was found in the Linux kernel's PA-RISC architecture support. This vulnerability can lead to a Denial of Service DoS when deep call chains cause a kernel stack overflow on 64-bit systems. A local user executing complex or resource-intensive workloads can trigger this condition, causing the...

CVE-2017-7184

CVE-2017-7184 – Linux Kernel XFRM Privilege Escalation No Sudo Overview This repository contains a proof-of-concept local privilege escalation exploit for CVE-2017-7184 , a Linux kernel vulnerability in the XFRM IPsec netlink subsystem. The exploit demonstrates how an unprivileged user can gain...

CVE-2026-119086: FreeRTOS FreeRTOS-Kernel: Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on…

Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue sets enabled allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privilege...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local privilege escalation exploiting CVE-2026-43499 — an rtmutex removewaiter bug that leaves a struct rtmutexwaiter dangling on the waiter's kernel stack kernel/locking/rtmutex.c, CWE-416 use-after-free. Adapted from NebuSec/CyberMeowfia...

setcred

FreeBSD setcred2 — research artifacts This subdirectory collects the write-up and working exploits for the setcred2 stack buffer overflow in FreeBSD 14.x kernel. The vulnerability itself is fully documented in setcred.txt. The short version: kernsetcredcopyinsuppgroups uses sizeofgroups where...

CVE-2026-98935

A flaw was found in the Linux kernel's Real-Time Clock RTC driver. This information disclosure vulnerability occurs because the driver fails to initialize memory padding within an internal data structure before copying alarm details to user space. A local user can exploit this flaw by querying th...

CVE-2026-89864

A flaw was found in the qla2xxx SCSI driver in the Linux kernel. This vulnerability allows a local attacker, with CAPSYSRAWIO capabilities, to cause heap and kernel stack corruption due to unbounded length fields in I2C bsg handlers. Successful exploitation could lead to privilege escalation or...

CVE-2026-98853

A flaw was found in the Linux kernel's Generic Segmentation Offload GSO implementation. When processing deeply nested IP-in-IP packets, recursive segmentation is not properly restricted, which can exhaust kernel stack memory. A remote attacker could exploit this vulnerability by transmitting...

DEBIAN-CVE-2026-98917

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 6.18.55 and 7.2.9. This vulnerability stems from a default insufficient size of the kernel stack in 64-bit kernels, which may lead to a kernel stack overflow and trigger a kernel crash...

PT-2026-121889

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREAD SIZE ORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian...

Linux Distros Unpatched Vulnerability : CVE-2026-99031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. F...

CVE-2026-98613

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service DoS by creating deeply nested or cyclical object references using local kernel pointers. During object cleanup, synchronous recursive...

CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...

CVE-2026-95108 Deleting a user-mode module thread leaks its privileged kernel stack

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TXTHREAD control block through txmmoduleobjectallocate; txmmodulemanagerthreadcreate then takes a second allocation of TXMMODULEKERNELSTACKSIZE bytes for...