cve-2026-23111-poc

CVE-2026-23111 For more details, see notes.md Description CVE Description from NIST An inverted logical check in nftmapcatchallactivate causes nftchain-use reference count to not be restored when a DELSET operation is aborted. This allows triggering UAF, and can be abused to obtain local privileg...

kasld

KASLD recovers the Linux kernel's virtual and physical memory layout — primarily the kernel text base — from a local process. What it can recover is a function of that process's vantage: its privileges and capabilities, the system's configuration, and any container confinement. It recovers the ba...

CVE-2026-46242

CVE-2026-46242 full poc and lpe Kernel Range Status Notes 5.15.209 - 5.16 Affected Backported introducing commit 6.1.175 - 6.2 Affected Backported introducing commit 6.4 - 6.18.32 Affected Bug introduced in mainline 6.4 6.19 - 7.0.9 Affected Includes latest stable v6.1-based Pixel 8, older NOT...

CVE-2023-0179-PoC

Needle CVE-2023-0179 exploit This repository contains the exploit for my recently discovered vulnerability in the nftables subsystem that was assigned CVE-2023-0179, affecting all Linux versions from 5.5 to 6.2-rc3, although the exploit was tested on 6.1.6. The vulnerability details and writeup c...

Auto-Root-Exploit

Auto-Root-Exploit Auto Root Exploit Tool Author : Nilotpal Biswas Facebook : https://www.facebook.com/nilotpal.biswas.73 Twitter : https://twitter.com/nilotpalhacker USAGE : for kernel version 2.6 all bash autoroot.sh 2 for kernel version 3 all bash autoroot.sh 3 for kernel version 4 all bash...

empty_list

emptylist - exploit for p0 issue 1564 CVE-2018-4243 iOS 11.0 - 11.3.1 kernel r/w @i41nbeer BUG: getvolattrlist takes a user controlled bufferSize argument via the fgetattrlist syscall. When allocating a kernel buffer to serialize the attr list to there's the following comment: / Allocate a target...

Platbox

Platbox UEFI and SMM Assessment Tool Features Platbox is a tool that helps assessing the security of the platform: Dumps the platform registers that are interesting security-wise Flash Locks MMIO and Remapping Locks SMM Base and Locks MSRs RW access to the PCI configuration space of devices. RW t...

kernel-exploit-factory

kernel-exploit-factory Keep updating...... Linux kernel CVE exploit analysis report and relative debug environment. You don't need to compile Linux kernel and configure your environment anymore. This repository is to extract all Linux kernel exploit and relative debug environment. You can use Qem...

ParrotSec-Linux-Hardening-Project

ParrotSec Linux - Public Kiosk Project Designing & Implementing A restricted & Trustworthy Environment Hardened kernel - GrSecurity Patched Kernel - PaX Hardening - x PaXctl - x PaXTest - x PaXctld - x Hardened Kernel Runtime Parameters - x Kernel Self Protection Project KSPP - x pti=on - Kernel...

Detection-and-Mitigation-for-CVE-2022-1679

Detection-and-Mitigation-for-CVE-2022-1679 The ath9k is a Linux kernel driver supporting Atheros chips. A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9khtcwaitfortarget function to fail with some input messages. This flaw...

cve-2017-16995

CVE-2017-16995 Writeup The folder containes a line-by-line source code analysis for CVE-2017-16995 Linux BPF local privilege escalation. Exploit and patch tested on kernel 4.4.0.116. Credits Special thanks to difengtang who has also contributed this writeup. Exploit scripts was created by @iBearc...

FreeBSD-9.0-9.1-Privilege-Escalation

FreeBSD-9.0-9.1 - Privilege-Escalation CVE-2013-2171 By [email protected] How to Exploit! 1° Check the kernel version uname -a FreeBSD freebsd 9.0-RELEASE FreeBSD 9.0-RELEASE 0: Tue Jan 3 07:46:30 UTC 2012 2° Transfer this file to target Attacker machine - python3 -m http.server 8080 Target...

CVE-2022-0847

CVE-2022-0847 Vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. To compile: gcc poc.c -o poc Usage: ./poc TARGETFILE OFFSET DATA Author and...

ghostlock-vagrant-box

Full Chain Vulnerability Testbed: Nginx RCE → GhostLock LPE Overview This repository provides a Vagrant environment designed to demonstrate a complete two-stage exploitation chain. The testbed automatically provisions an isolated Ubuntu 22.04 LTS virtual machine that is intentionally configured t...

rmgp-complete-handoff

rmgp-complete-handoff Complete workspace + experiment-state backup for the CVE-2026-43499 RMGP / "popsicle" exploit targeting SM-A376B / Exynos S5E8845 / A376BXXU1AZB7. ReadCURRENTSTATE.md first — it is the authoritative "where we are" note: what works slide, skb leak, pipe oracle, 1st KernelSnit...

CVE-2022-26937

Windows Network File System Crash PoC CVE-2022-26937 nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a critical data structure. The...

totally-not-spyware

TotallyNotSpyware This program is definitely not spyware. Run it on your 64-bit iOS device as soon as possible. Your compliance will be rewarded. Live version at totally-not.spyware.lol Repo structure & building Frontend and WebKit exploit are in /root. Kernel exploit is in /glue. Post-exploitati...

CVE-2026-93129

A flaw was found in the Linux kernel's dell-wmi-base driver. This vulnerability occurs due to an incorrect index used when accessing data fields related to the ultra performance key, which can lead to a potential buffer over-read. A local attacker could potentially exploit this to read sensitive...

CVE-2026-93123

A flaw was found in the Linux kernel's qcom-geni serial driver. When the uartflushbuffer function is called after a Direct Memory Access DMA transfer completes but before its completion interrupt is processed, the transmit buffer can be reset. If new data is written to the buffer before the stale...

CVE-2026-93115

A flaw was found in the Linux kernel's Mellanox mlxbf-pmc driver. A local attacker could exploit this by forcing the driver to bind to a device lacking an ACPI Advanced Configuration and Power Interface companion object. This action triggers a NULL pointer dereference, which can lead to a system...