CVE-2026-31431

CVE-2026-31431 Archivo y análisis de "Copy Faill" CVE-2026-31431. Código fuente para el ataque Pruebas Herramientas de sniffing para la vulnerabilidad potencial. Solución root@kitploit: 禁用内核模块 echo "install algifaead /bin/false" /etc/modprobe.d/disable-algif-aead.conf 卸载已加载模块 rmmod algifaead...

CVE-2023-6931

CVE-2023-6931 针对CVE-2023-6931的内核恐慌PoC 描述 CVE-2023-6931是perfevent中的一个漏洞，由组中readsize的整数溢出导致堆缓冲区溢出。 什么是性能事件（perf event）？ perfevents是Linux内核提供的一个性能监控和分析框架。该框架能够跟踪硬件和软件组件产生的各种性能相关数据。 主要用途 硬件事件跟踪 跟踪CPU周期、指令执行次数、缓存未命中等事件。 软件事件跟踪 监控诸如进程切换、缺页异常、上下文切换等事件。 自定义事件跟踪 允许跟踪特定应用程序或内核的事件。 perf的组件 perfeventopen系统调用...

COPY-FAIL

Copy Fail -- CVE-2026-31431 为红队和授权渗透测试操作而强化的C语言实现。 ⚠️ 法律声明： 本工具仅用于授权的安全研究、授权的渗透测试和防御性分析。仅可在您拥有或获得明确书面授权测试的系统上使用。未经授权访问计算机系统是违法的。 🚀 主要开发已迁移至GitLab。 此仓库在此处积极维护。如有问题或贡献，请使用GitLab。 目录 概述 原始研究 我们的改进 架构 构建 使用 模块 操作安全 检测与缓解 致谢 许可证 概述 本项目是CVE-2026-31431 （"Copy Fail"）本地权限提升漏洞的一个强化、生产就绪的C语言移植版本，最初由Theori...

CVE-2026-31431

CVE-2026-31431 — 通过 AFALG 实现本地权限提升 2026-04-29 — 我在MyDigitalLife 论坛 分享此漏洞利用代码一天后，将其公开发布。 它不需要 Python；使用 C 语言编写，并通过以下命令编译为尽可能小的体积： root@kitploit: musl-gcc -static -Os -o exploit exploit.c -s 严重威胁。该漏洞利用二进制文件编译时无任何依赖，可用于测试任何 Linux 系统是否存在漏洞。 CVE-2026-31431 是 NIST 确认的 Linux 内核漏洞，允许非特权本地用户在数秒内获得 root...

CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

EUVD-2026-80657

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90049

CVE-2026-90049 is a Linux kernel vulnerability in skb_zerocopy() (net/skbuff). On an skb_orphan_frags() failure, the function calls skb_tx_error() on the source skb it does not own, prematurely completing the zerocopy uarg and clearing the SKBFL_SHARED_FRAG page-ownership flag. On Open vSwitch's ...

CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

CVE-2026-90049

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skbtxerror the source skb in skbzerocopy skbzerocopy copies frags from @from into @to. On an skborphanfrags failure it calls skbtxerror@from, a destructive operation on the source skb the copy helper does not...

EUVD-2026-80656

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

CVE-2026-90048

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in nicreateattrlist nicreateattrlist allocates a fixed buffer of alalignedrecordsize == recordsize bytes and then walks every attribute of the primary MFT record, writing one ATTRLISTENTRY p...

CVE-2026-90046 mm/page_alloc: don't spin_trylock() in NMI on UP

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

CVE-2026-90047

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...

EUVD-2026-80655

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM getflatccsoffset reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below...

CVE-2026-90046 mm/page_alloc: don't spin_trylock() in NMI on UP

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

CVE-2026-90046

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

EUVD-2026-80654

In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: don't spintrylock in NMI on UP Patch series "mm/pagealloc: fixes for freepagesnolock on RT/UP". Pre-existing bugs found by Sashiko during review of this other series:...

CVE-2026-90046

CVE-2026-90046 is a Linux kernel vulnerability in the mm/page_alloc subsystem where free_pages_nolock() uses spin_trylock() in NMI context on UP (uniprocessor) builds, an unsafe usage previously noted in can_spin_trylock(). A prior commit fixed the allocation side but missed the free side. The im...

CVE-2026-90047

This vulnerability affects the Linux kernel's drm/xe driver (Intel Xe GPU driver). The get_flat_ccs_offset() function incorrectly rounds up the flat CCS (Compressed Caching System) storage boundary to 128 KiB instead of rounding down to the allocator's page size, exposing a small region of memory...