kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

A flaw was found in the Linux kernel's netfilter component, specifically within the nftsetpipapoavx2 AVX2 matching functions. This vulnerability occurs when a pipapo set with an 'ipv4 . port' key is reloaded. Due to incorrect masking, the system may erroneously identify non-matching elements as...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

kernel: smb/client: fix out-of-bounds read in smb2_compound_op()

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote attacker, acting as a malicious SMB server, could send a specially crafted, truncated response with an oversized buffer length. This could lead to an out-of-bounds read in the smb2compoundop function, allowing the...

kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...

kernel: RDMA/mana: Validate rx_hash_key_len

A flaw was found in the Linux kernel's RDMA/mana component. A local user could exploit this vulnerability by providing an invalid rxhashkeylen value through a user-space API uAPI structure. This invalid value is then used in a memcpy operation without proper bounds checking, allowing the user to...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

CVE-2020-8423

CVE-2020-8423 基于 https://ktln2.org/2020/03/29/exploiting-mips-router/testing-environment 的研究 hook.c 已被定制（尤其是 open） vmlinux 版本 2.6.31...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

CVE-2023-1829

CVE-2023-1829 이 취약점은 Ubuntu22.04 공식 소스 코드 5.15.0-25.25에서 테스트되었습니다. 일부 netlink 필터 함수에 대한 의존성 설치 root@kitploit: sudo apt install libnftnl-dev libmnl-dev 빌드 단계: root@kitploit: make 참조 https://github.com/randorisec/CVE-2022-34918-LPE-PoC/tree/main...

CVE-2024-6387

0. 요약 이는 본질적으로 통계적 취약점입니다. 경쟁 조건을 이기고 임의 코드 실행에 성공하려면 많은 시도가 필요하며, 공격자는 많은 장애물을 극복해야 합니다.”라고 Schwartz는 SecurityWeek에 말했습니다. “최상의 경우에도 가장 잘 알려진 취약점은 실행하는 데 4시간 이상이 걸립니다.” OpenSSH 9.8 릴리스 노트에서 개발자는 이 취약점이 glibc 기반 32비트 Linux 시스템에서만 확인되었으며, OpenBSD는 영향을 받지 않는다고 밝혔습니다. 1. 환경 설정 환경 설정은 Docker를 사용합니다...

Linux Distros Unpatched Vulnerability : CVE-2026-18090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image...

ALSA-2026:64815 Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

Oracle Linux 10 : ELSA-2026-64785-0: / 389-ds-base (ELSA-2026-647850)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-647850 advisory. - Resolves: RHEL-220500 - CVE-2026-18355 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket...

RHEL 9 : pam (RHSA-2026:64815)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64815 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

Oracle Linux 10 : ELSA-2026-65162-0: / gpsd (ELSA-2026-651620)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-651620 advisory. 3.26.1-3.0.1.el102.2 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.2 - fix another command injection in gpsprof CVE-2026-60122 Tenable has...

NewStart CGSL MAIN 7.02 : kernel Multiple Vulnerabilities (NS-SA-2026-0086)

The remote NewStart CGSL host, running version MAIN 7.02, has kernel packages installed that are affected by multiple vulnerabilities: - In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabufexpfrompages dmabuffd fixes; no preferences regarding the tree it goes...

Linux Distros Unpatched Vulnerability : CVE-2026-62437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated remova...

Linux Distros Unpatched Vulnerability : CVE-2026-79604

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - xen - None Ubuntu Linux - oxenstored: Unbounded accumulation of watches: Oxenstored maintains two datastructures about watches; one global trie,...

Oracle Linux 10 : ELSA-2026-64799-0: / glib2 (ELSA-2026-647990)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-647990 advisory. - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime byte-swap - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validatio...