Linux kernel Bluetooth DoS

The vulnerability in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

aiptekirq Heap Buffer Overflow DoS

The vulnerability of the aiptekirq function in the drivers/input/tablet/aiptek.c module of the Linux kernel is related to the lack of data validation for data received in interrupt packets from potentially compromised USB devices. Exploiting this vulnerability could allow an attacker to cause...

copy-fail-CVE-2026-31431

Copy Fail - CVE-2026-31431 Technical Writeup Tested Distro / Version Distro| Version ---|--- Ubuntu 24.04 LTS| 6.17.0-1007-aws Amazon Linux 2023| 6.18.8-9.213.amzn2023 RHEL 10.1| 6.12.0-124.45.1.el101 SUSE 16| 6.12.0-160000.9-default...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x-7.x x86/x8664 and ARM/ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid makes the...

linux-kernel-exploits

linux-kernel-exploits Introduction linux-kernel-exploits Vulnerability List CVE Description Kernels CVE–2018–18955 mapwrite in kernel/usernamespace.c allows privilege escalation Linux kernel 4.15.x through 4.19.x before 4.19.2 CVE–2018–1000001 glibc glibc 2.6.22 released in 2007 CVE-2016-2384 a...

CVE-2026-98899

A flaw was found in the Linux kernel's Netfilter subsystem. A local attacker can cause a Denial of Service DoS or potentially achieve privilege escalation by exploiting improper locking mechanisms in the IP set ipset component. When manipulating hash tables, incorrect synchronization during memor...

CVE-2026-98901

A flaw was found in the Linux kernel's ksmbd module, an in-kernel Server Message Block SMB file sharing service. An authenticated remote client can cause a localized Denial of Service DoS or introduce file cache inconsistencies due to improper handling of lease break requests and acknowledgments...

CVE-2026-99163

A flaw was found in the Linux kernel's tracing subsystem. This vulnerability allows a local user with tracing privileges to cause a Denial of Service DoS or potentially corrupt kernel memory by creating synthetic events with mismatched field types. Due to improper type validation, the kernel...

kernel: smb: client: validate dacloffset before building DACL pointers

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List DACL fields...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

kernel: smb: client: validate dacloffset before building DACL pointers

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious server can exploit this vulnerability on 32-bit systems by providing a crafted dacloffset value. This can cause a pointer wrap, leading to the dereferencing of invalid Discretionary Access Control List DACL fields...

kernel: net: tun: bound receive headroom

A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...

UBUNTU-CVE-2026-99271

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prevfbuf on capture buffer release A KASAN slab-use-after-free read was reported in submitaudioouturb when generating an impulse test signal: BUG: KASAN: slab-use-after-free in createimpulsetestsignal...

UBUNTU-CVE-2026-99272

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

UBUNTU-CVE-2026-99279

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory and connection slots when no further setu...

UBUNTU-CVE-2026-99274

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated response smb3fiemap treats -E2BIG from SMB2ioctl as a truncated range blob and loops for the next chunk. If the server reports STATUSBUFFEROVERFLOW with OutputCount == 0,...

UBUNTU-CVE-2026-99276

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks are busy The expiration worker holds connlistlock for reading while checking for authenticated sessions. Without this change, the check can wait for conn-sessionlock or...

UBUNTU-CVE-2026-99280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the...

UBUNTU-CVE-2026-99283

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 "netfilter: conntrack: tcp: only close if RST matches exact sequence" keeps an established conntrack entry in ESTABLISHED when an...

UBUNTU-CVE-2026-100081

In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvifmcastaddrlistfree In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvifstartxmit, while adds/removes happ...