kernel: ALSA: seq: close a re-opened queue timer in the destructor

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 "Copy Fail" — Universal LPE Exploit Linux kernel page cache 4-byte arbitrary write → Local Privilege Escalation Multiple exploit approaches: dynamic ELF entry point overwrite, full binary replacement, Python 3.x compatible with ctypes splice fallback. What is this? CVE-2026-31431 i...

CVE-2026-31431-Patch

CVE-2026-31431 Copy Fail Mitigation & Patch Script Image Before Patch and Vulnerable Image After Patch With Script This repository contains a specialized bash script designed to mitigate and patch CVE-2026-31431 , also known as "Copy Fail". This vulnerability is a critical Local Privilege...

kmon

Linux Kernel Manager and Activity Monitor 🐧💻 The kernel is the part of the operating system that facilitates interactions between hardware and software components. On most systems, it is loaded on startup after the bootloader and handles I/O requests as well as peripherals like keyboards, monitor...

CVE-2026-98647

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability allows a local user to cause a Denial of Service DoS by crashing the kernel. When loading a specially crafted BPF program that accesses a structure with an empty flexible array member, the verifier...

CVE-2026-98646

A flaw was found in the Linux kernel's TCP subsystem. A local user running Berkeley Packet Filter BPF programs can cause a Denial of Service DoS by crashing the system. This issue occurs when destroying a listening TCP socket with pending connection requests, mistakenly invoking a sleeping...

Copy-Fail_Detect_and_mitigate_CVE-2026-31431

Copy Fail - CVE-2026-31431 Detector and Mitigator Detect exposure to CVE-2026-31431 Copy Fail and optionally apply a host-level mitigation by disabling the algifaead kernel module on vulnerable systems. What this repo provides copyfail-check.sh — checks kernel patch status, runtime module exposur...

LSPromise

LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...

CVE-2026-26030-Microsoft-Semantic-Kernel-1.39.4-RCE

Microsoft Semantic Kernel BPassed to VectorStore query/filter B -- CInMemoryVectorStore evaluates filter expression unsafely C -- DUnsafe attribute resolution via class / base / subclasses D -- EAccess to init.globals containing os and builtins E -- FArbitrary code execution e.g. os.system F --...

CVE-2026-114135 Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal KernelWebsocketHandler with WebSocketChannelsHandler, which authenticated the user but did not call authorizer.isauthorized... for the execute action on the kernels...

CVE-2026-114135

Jupyter Server (versions 2.0.0 through 2.6.0) is vulnerable to an authorization bypass when GatewayClient.url is enabled. The WebSocketChannelsHandler fails to call authorizer.is_authorized(...) for the execute action on the kernels resource, allowing a restricted authenticated user to open an up...

sgx-step

A Practical Attack Framework for Precise Enclave Execution Control SGX-Step is an open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX platforms in particular. SGX-Step consists of an adversarial Linux kernel driver and a small user-spa...

CopyFail-Scanner-CVE-2026-31431

CopyFail-Scanner-CVE-2026-31431 CopyFail-Scanner is a tool that identifies the CopyFile vulnerability CVE-2026-31431. Enumerates the system Assesses exposure to the vulnerability Indicates the status vulnerable/not vulnerable Suggests and, optionally, executes a secure update based on the distro...

CVE-2026-31431-Copy-Fail

CVE-2026-31431 — Copy Fail Severity: Critical CVSS v3.1: 9.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Status: Public Exploit Available Summary CVE-2026-31431 "Copy Fail" is a local privilege escalation vulnerability in the Linux kernel cryptographic subsystem. Any unprivileged user can escalate to roo...

CVE-2026-98643

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This flaw can lead to information disclosure when a BPF socket operations program reads the round-trip time rttmin field during TCP connection handling. Because the kernel fails to verify the socket type before casting i...

CVE-2026-98645

A flaw was found in the Linux kernel's Winwing Human Interface Device HID driver. The driver improperly manages memory when releasing force-feedback resources, leading to an invalid memory release and subsequent double free. A local user could trigger this flaw during device disconnection, driver...

CVE-2026-98644

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local user could cause a Denial of Service DoS by executing batch lookup or deletion operations on large hash maps. Due to a missing rescheduling check when traversing consecutive empty hash table entries, the kernel c...

copy-fail-go

copy-fail-go Go port of grenkoca's Python PoC for CVE-2026-31431 copy-fail. This version compiles to a fully static binary with zero runtime dependencies - no Python, no pip, no libc version constraints. Drop it on any Linux target and run it. It also automatically enumerates all SUID...