MAccConc

Overview This is tooling for exploring Linux kernel race conditions and for general kernel debugging. See also the announcement blog post https://projectzero.google/2026/09/maccconc-race-condition.html. There are currently three tools: 1. A GUI for viewing KCOV traces of Linux kernel execution an...

linux-4.19.72_CVE-2022-29581

Linux kernel There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first. In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentatio...

dirtyclone-exploit

DirtyClone Exploit Framework CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9 ╔═══════════════════════════════════════════════════════════════╗ ║ ║ ║ | \ | | / | | ║ ║ | | | | | '| | | | | | | |/ | ' \ / \ ║ ║ | || | ...

CVE-2026-98422

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with network administration privileges can cause a Denial of Service DoS by repeatedly activating and deactivating Access Point Virtual Local Area Network APVLAN interfaces. When an APVLAN interface is stopped, the...

CVE-2026-98424

A flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem. This flaw allows a local user to cause a Denial of Service DoS when switching a wireless device between network namespaces isolated virtual network environments. If the device rename operation fails due to memory...

CVE-2026-98404

A flaw was found in the Linux kernel's VirtIO GPU driver. A local user could exploit this flaw to cause a Denial of Service DoS by triggering a system crash. When user framebuffer creation encounters an error, the driver improperly returns a null value instead of an error code, resulting in a nul...

CVE-2026-64531

CVE-2026-64531 — OVSwrap Linux kernel Open vSwitch module local privilege escalation normal user → root PoC. Exploits the integer wraparound of the 16-bit nlalen field to escalate from a normal user all the way to root. Vulnerability Summary When the nested action stream generated by OVS exceeds...

CVE-2026-98415

A flaw was found in the Linux kernel's Samsung Exynos Power Management Unit PMU driver. A local attacker could exploit a use-after-free vulnerability caused by the premature release of a device tree configuration node during CPU power management initialization. This issue may lead to a Denial of...

optee-qemu

CVE-2021-44733: Fuzzing and exploitation of a use-after-free in the Linux kernel TEE subsystem Recently a use-after-free vulnerability was discovered in the Linux kernel TEE subsystem, up to and including version 5.15.11, and was assigned CVE-2021-44733 1. At a first glance it did not seem to be...

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops AND, OR and XOR in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. Compile: gcc -o pwn pwn.c && gcc -o exploit exploit.c...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2026-31431-Analysis

CVE-2026-31431-Analysis Technical Analysis Report: Exploitation of Isolation Failure in the Linux Kernel CVE-2026-31431...

cve-2026-31431-mitigation

CVE-2026-31431 Copy Fail – Technical Mitigation Tooling 1. Overview This package provides an automated solution to detect and mitigate the CVE-2026-31431 vulnerability aka Copy Fail on Linux systems running affected kernels versions 4.14 through 6.12.84, 6.13 through 6.18.21, etc.. The tooling...

CVE-2022-0435-Poc

CVE-2022-0435stack overflow wget https://releases.ubuntu.com/jammy/ubuntu-22.04.5-live-server-amd64.iso mkdir kernel wget https://kernel.ubuntu.com/mainline/v5.13/amd64/linux-headers-5.13.0-051300-generic5.13.0-051300.202106272333amd64.deb wget...

CVE-2026-43284-DIRTY-FRAG-

CVE-2026-43284-DIRTY-FRAG- Detailed technical analysis of CVE-2026-43284 Dirty Frag local privilege escalation flaw in the Linux kernel. CVE-2026-43284 commonly referred to as part of the Dirty Frag vulnerability suite is a critical local privilege escalation LPE flaw in the Linux kernel. It stem...

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

A flaw was found in the Linux kernel's netfilter nfnetlinkqueue component. This vulnerability occurs when an application does not set the FGSO capability flag and a Generic Segmentation Offload GSO packet with an unconfirmed netfilter connection nfconn entry is received. Due to an incorrect order...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

A flaw was found in the Linux kernel's networking scheduler, specifically within the taprio module. When the system attempts to switch schedules, a use-after-free vulnerability occurs in the advancesched function. This happens because a pointer to an old schedule entry is still used after the...

kernel: USB: serial: mxuport: fix memory corruption with small endpoint

A flaw was found in the Linux kernel's USB serial mxuport driver. A malicious Universal Serial Bus USB device could exploit this vulnerability by reporting a bulk-out endpoint maximum packet size smaller than eight bytes. This can lead to user-controlled slab corruption, potentially allowing an...