Exploit for CVE-2026-68136

CVE-2026-68136 / GHSA-p4gp-483j-wr28 — PoC: Linux kernel GRO d...

CVE-2026-89853

A flaw was found in the Linux kernel's qla2xxx SCSI driver. A use-after-free vulnerability occurs due to a race condition between freeing the FCE trace buffer and its use during a firmware dump. A local attacker could potentially exploit this by disabling the debugfs FCE trace, leading to system...

CVE-2026-89857

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs because a specific function responsible for sending NVMe Local-Scope LS rejects does not properly acquire a necessary lock. This oversight allows for concurrent operations, which can corrupt the internal state o...

CVE-2026-89858

A flaw was found in the Linux kernel's qla2xxx driver. A local user could exploit this vulnerability by sending a specially crafted Block SCSI Generic BSG request with an excessively large image count. This could cause the system to read beyond the intended memory buffer, leading to the disclosur...

CVE-2026-89860

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs when an abort operation is initiated multiple times for the same command, leading to a race condition. During this race, a work item can be reinitialized while it is still active in the kernel's processing queue...

CVE-2026-89861

A flaw was found in the Linux kernel's qla2xxx SCSI driver. This vulnerability occurs in the qla24xxreportidacquisition function where a virtual port reference is not properly maintained. A local attacker could exploit this timing issue, allowing a concurrent operation to free the virtual port...

CVE-2026-89864

A flaw was found in the qla2xxx SCSI driver in the Linux kernel. This vulnerability allows a local attacker, with CAPSYSRAWIO capabilities, to cause heap and kernel stack corruption due to unbounded length fields in I2C bsg handlers. Successful exploitation could lead to privilege escalation or...

CVE-2026-89879

A flaw was found in the Linux kernel's s2255 media driver. The driver fails to properly validate the size of JPEG frames received from a device. A malicious or malfunctioning device can provide an oversized jpgsize value, causing a buffer overflow when the data is copied. This could allow an...

CVE-2026-89891

A flaw was found in the em28xx media driver of the Linux kernel. When a specific type of device is disconnected, a programming error can occur where a pointer to freed memory remains in an active list. This "use-after-free" vulnerability can be triggered by a local attacker or a malicious USB...

CVE-2026-89897

A flaw was found in the Linux kernel's media subsystem, specifically within the Consumer Electronics Control CEC framework. The cecreceivenotify function reads the exclusive follower pointer without proper locking, creating a race condition. This lack of serialization during exclusive follower...

CVE-2026-89892

A flaw was found in the Linux kernel's em28xx media driver. This vulnerability occurs because the audio-only path incorrectly registers extensions during device probing, leading to a duplicate device entry in an internal list. This duplicate entry can be freed while still being referenced,...

CVE-2026-89899

A flaw was found in the Linux kernel's Consumer Electronics Control CEC subsystem. This vulnerability occurs when a transmit operation is interrupted, leading to a delayed work item remaining active after its associated data has been freed. A local attacker could potentially exploit this...

CVE-2026-89911

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine component. A guest operating system can trigger an integer overflow in the TLB Translation Lookaside Buffer Invalidation by Range mechanism. This occurs when the hypervisor incorrectly handles a large range value provided by...

CVE-2026-98847

A flaw was found in the Linux kernel's SPEAr Real-Time Clock RTC driver. The driver requests and enables an alarm interrupt before completing device initialization, specifically prior to setting up the memory-mapped I/O MMIO address and spinlock. If an interrupt triggers while device probing is i...

CVE-2026-89913

A flaw was found in the KVM Kernel-based Virtual Machine arm64 vgic-v3 component of the Linux kernel. A race condition exists where the vgicv3savependingtables function can dereference a freed vgicirq structure due to improper handling of LPI Locality-sensitive Paging Interrupt references. This...

CVE-2026-98846

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. A race condition can occur when an SCTP socket is shut down concurrently while waiting for a connection, causing an association structure to be freed while still in use. A local user could exploit this fla...

CVE-2026-98845

A flaw was found in the Linux kernel's Trusted Platform Module TPM subsystem. This vulnerability allows an attacker to bypass TPM reset protections because the driver fails to disable the device when a null key integrity check fails. Consequently, the TPM continues serving requests and...

CVE-2026-89917

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architectures. A race condition exists between the Virtual Nested Cache Register VNCR Translation Lookaside Buffer TLB invalidation and the vcpuput function's unmapping of the VNCR page. This time-of-check to...

CVE-2026-89919

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component for s390 architecture. This vulnerability occurs due to improper synchronization when handling memory management unit MMU locks. Specifically, concurrent operations related to key operations and virtual machine memo...

CVE-2026-98844

A flaw was found in the Linux kernel's network filesystem netfs subsystem. When a file is extended through write operations after previous writes were performed via memory mapping, the system fails to clear stale cache data located beyond the original end of the file. A local user could exploit...