CVE-2026-98258

A flaw was found in the Linux kernel's POSIX CPU timer subsystem. A race condition can occur when modifying or deleting a timer concurrently with its expiration handling, allowing the timer to be freed while still queued on an active expiry list. A local user could exploit this use-after-free UAF...

CVE-2026-98257

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. A remote attacker can trigger a Denial of Service DoS by negotiating an incompatible protocol version during connection establishment. This mismatch causes the kernel to attempt a synchronous connection teardown while...

CVE-2026-98256

A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege...

CVE-2026-98255

A flaw was found in the Linux kernel. Its TCP Transmission Control Protocol fast-path processing logic fails to properly filter out-of-bounds acknowledgment ACK packets before validating them. A remote attacker could exploit this vulnerability by sending network packets with outdated ACK numbers,...

CVE-2026-98254

A flaw was found in the Linux kernel's Software I/O Translation Lookaside Buffer swiotlb. During Direct Memory Access DMA bounce operations involving high memory, an incorrect address calculation occurs when an offset crosses a page boundary. This error causes data transfers to read from or...

CVE-2026-98252

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA subsystem. This flaw allows a local attacker to cause a denial of service DoS due to a race condition in the iWARP port mapper component. Because request structures are added to a shared tracking list before their reference...

CVE-2026-98251

A flaw was found in the Linux kernel's Open vSwitch component. When handling network connection tracking conntrack labels, the kernel may reallocate memory for active connections while another processor accesses it simultaneously. This race condition can lead to memory corruption, allowing an...

CVE-2026-98384

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When processing socket destruction requests through the bpfsockdestroy helper, the kernel fails to properly verify if a socket is a full socket before attempting to read its protocol field, causing an out-of-bounds memor...

CVE-2026-98382

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This vulnerability allows a privileged local user to cause a Denial of Service DoS by triggering an out-of-bounds memory read. When handling device-bound programs, improper validation allows a program intended for one...

CVE-2026-98381

A flaw was found in the Linux kernel's virtual Ethernet veth driver. When resizing network channels, the driver fails to properly clear references to detached eXpress Data Path XDP programs on removed receive queues. If the channel count is subsequently increased, the kernel may execute the freed...

CVE-2026-98380

A flaw was found in the Linux kernel's traffic control subsystem. A local attacker with network configuration privileges can exploit a race condition during traffic control action deletion to cause a Denial of Service DoS by crashing the system. Due to missing error validation during action...

CVE-2026-98379

A flaw was found in the Linux kernel's netfilter subsystem. An unprivileged local user can cause a Denial of Service DoS by triggering a system crash through a null pointer dereference an attempt to access invalid memory. This issue occurs during IPv6 reverse-path filtering when the kernel...

pipe-primitive

pipe-primitive An exploit primitive in linux kernel inspired by DirtyPipe CVE-2022-0847. Alcuni giorni fa, come molti esperti di sicurezza prima di me, ho studiato e riprodotto la vulnerabilità DirtyPipe CVE-2022-0847, rendendomi profondamente conto di quanto sia utile. La falla nasce da un...

CVE-2026-98378

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local attacker can trigger a use-after-free flaw by iterating over BPF links while a concurrent link creation operation fails. This issue occurs because the iterator references links before their initialization is...

oppo-ghostlock

oppofindN2-ghostlock GhostLock CVE-2026-43499 — OPPO Find N2 Linux-Kernel-Privilegieneskalation-Forschung Projektübersicht GhostLock CVE-2026-43499 ist eine Kernel-Stack-UAF-Schwachstelle, die Linux 2.6.39 bis 7.1-rc1 betrifft und durch eine Race Condition in FUTEXCMPREQUEUEPI ausgelöst wird...

CVE-2026-98377

A flaw was found in the Linux kernel's VLAN Virtual Local Area Network networking component. A local user can exploit this vulnerability by transmitting crafted, undersized network frames that trigger multiple VLAN tag insertions without verifying the presence of a Media Access Control MAC header...

CVE-2026-98376

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When replacing an inner per-CPU array map within a map-in-map structure, the kernel fails to verify that the replacement map matches the size of the original template map. A local attacker can exploit this flaw by...

CVE-2026-98375

A flaw was found in the Linux kernel's Xen network frontend driver. This vulnerability allows a malicious host backend to cause a Denial of Service DoS by transmitting incoming network packets with an incomplete Ethernet header. Because the driver fails to verify that incoming packet buffers meet...

CVE-2026-98352

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA Transport client driver. A race condition occurs when a connection setup attempt is interrupted during teardown, causing shared Completion Queue CQ resources to be retained without being released. This flaw may allow an...

CVE-2026-98351

A flaw was found in the Linux kernel's virtual Wi-Fi virtwifi driver. This issue can result in a Denial of Service DoS due to an unreleased memory leak. When a simulated wireless link is disconnected, the driver fails to free packet buffers after dropping outgoing network packets. A local user ca...