CVE-2023-5178

CVE-2023-5178 CVE-2023-5178：NVMe-oF-TCP 漏洞 的利用程序，该漏洞是 NVMe-oF-TCP 驱动程序在处理损坏的 Initialize Connection Request 时的一个逻辑错误。它导致 kmalloc-96 中的竞态双重释放 ，可以被利用来获得 LPE（参见下面的演示）。 该漏洞利用针对 Ubuntu 23.10 及 6.5.0-9-generic 内核（最新受影响的内核版本）。 通过更改内核符号和调整 ropchain，可以轻松地将其移植到早期的 v6 内核。 移植到内核版本 v5 需要进行一些小的修改，我将在文章中进行讨论。在 v...

Linux Distros Unpatched Vulnerability : CVE-2026-89699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a clien...

Linux Distros Unpatched Vulnerability : CVE-2026-89533

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - svcrdma: Fix offset arithmetic in readchunkrange svcrdmareadchunkrange walks a Read chunk's segment list to build a sub-range starting at byte offset and spanni...

DEBIAN-CVE-2026-89699

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-89552

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure paramsetcharp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4decodecreate accepts an unbounded crdatalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several Mi...

CVE-2026-80970 ALSA: FCP: do not copy out an uninitialised init response

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-80970

CVE-2026-80970 affects the Linux kernel ALSA FCP USB audio driver. In fcp_ioctl_init(), the response buffer is allocated via kmalloc() without being zeroed. Because the step-0 USB control transfer does not set URB_SHORT_NOT_OK, a short or zero-length data stage is accepted as success, and snd_usb...

EUVD-2026-76293

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcpioctlinit allocates its response buffer with kmalloc and copies the whole buffer back to userspace: bufsize = init.step0respsize + init.step2respsize; void resp freekfr...

CVE-2026-11108-Integer-Overflow-in-Memory-Allocator-kmalloc-Sim-

CVE-2026-11108 – Desbordamiento de entero en asignador de memoria kmalloc Sim Código del programa C root@kitploit: // allocsim.c - Vulnerable memory allocator include include include define MAXBLOCK 1024 void mymallocsizet size sizet total = size + sizeofsizet; // header if total MAXBLOCK return...

PT-2026-90415

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4 decode create accepts an unbounded cr datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several...

PT-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: do not copy out an uninitialised init response fcp ioctl init allocates its response buffer with kmalloc and copies the whole buffer back to userspace: buf size = init.step0 resp size + init.step2 resp size; void resp...

PT-2026-90268

In the Linux kernel, the following vulnerability has been resolved: params: fix charp corruption on allocation failure param set charp stores charp parameters in allocated memory after slab is available, and releases the previous value when the parameter is updated. The previous value is released...

Linux_LPE_io_uring_CVE-2021-41073

LinuxLPEiouringCVE-2021-41073 Exploit de LPE para la vulnerabilidad de confusión de tipos iouring CVE-2021-41073. Consulta el writeup Put an iouring on it: Exploiting the Linux Kernel. autor: @chompie1337 Solo con fines educativos/de investigación. No apto para pruebas o evaluaciones de seguridad...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098772)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098772 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfsioctlspaceinfo slotcount TOCTOU which can lead to info-leak btrfsioctlspaceinfo h...

Astra Linux – Vulnerability in Linux

A issue was discovered in the Linux kernel before version 5.8.10. The file virt/kvm/kvmmain.c contains a memory leak in kvmiobusunregisterdev due to a kmalloc failure, identified as CID-f65886606c2d...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: iouring: add a schedule point in ioaddbuffers Looping 65535 times doing kmalloc calls can trigger soft lockups, especially with DEBUG features like KASAN. 253.536212 watchdog: BUG: soft lockup - CPU64 stuck for 26s!...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Issue: overlay – Fix null pointer dereferencing in finddupcsetnodeentry and finddupcsetprop. When kmalloc fails to allocate memory in kasprintf, fn1 or fn2 will be NULL, and strcmp will cause a null pointer dereference...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: media: coda: A check for kmalloc has been added. Since kmalloc may return a NULL pointer, it is better to check the return value to avoid dereferencing a NULL pointer, just like with the other cases...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: exfat: Use kvmallocarray/kvfree instead of kmallocarray/kfree. The call stack shown below represents a scenario in the Linux 4.19 kernel. Memory allocation failed for the exfat file system, due to system memory fragmentation...