Linux Kernel Security Vulnerabilities

The Linux kernel version 6.14 contains security vulnerabilities. These vulnerabilities stem from the zpcireportstatus function in the s390/pci framework, which accesses device drivers without acquiring a device lock when pdev is not NULL. This can lead to inconsistent states...

Linux Kernel Security Vulnerabilities

The Linux kernel version 7.2 contains a security vulnerability. This vulnerability arises from the use of canceldelayedwork, which does not wait for the ongoing work callbacks to complete during the removal process. As a result, the callbacks are executed concurrently with hidhwclose and hidhwsto...

Linux Kernel Security Vulnerabilities

The Linux kernel has a security vulnerability. This vulnerability stems from the atl1 driver’s improper handling of the out-of-bounds cmbtpdnexttoclean value reported by hardware during PCIe link/mac reset operations. This could lead to loops that cannot be exited, resulting in a soft lock...

Linux Kernel Security Vulnerabilities

The Linux kernel version 2.6.12 has a security vulnerability. This vulnerability stems from the function rtmt6check, which allows the configuration of rtinfo-addrnr to 0 when the request address matches certain conditions. This bypasses the loop termination condition in the IP6TRTFSTNSTRICT path...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.15 contains security vulnerabilities. These vulnerabilities stem from improper sequencing of canceling wdtwork and releasing WDT IRQ. As a result, the watchdog interrupt may reschedule tasks and access memory that has been released, leading to reuse of freed resources...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.13 contains a security vulnerability. This vulnerability arises from nftables not skipping expired elements when inserting or deleting catchall elements. As a result, expired elements become invisible but still prevent reinsertion or incorrect deactivation of elements...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.16 contains a security vulnerability. This vulnerability arises from the process of local endpoint learning, where peer-lock is updated in place by reading bind-local. Since the UDP TX field is read without locking, it may lead to address tearing during concurrent IPv6...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.4 contains a security vulnerability. This vulnerability arises from the fact that the stackslotobjgetspi function does not reject non-negative offsets. When the offset is 0, the calculated spi index is the same as the valid stack slot at fp-8. This may lead to...

Linux Kernel Security Vulnerabilities

The Linux kernel version 5.8 contains a security vulnerability. This vulnerability stems from the bpfsock context code, which fails to ensure that the width of the read value is consistent with the assumptions of the verifier when reading the rxqueuemapping field. As a result, the values of runti...

Linux Kernel Security Vulnerabilities

The Linux kernel version 3.13 has a security vulnerability. This vulnerability stems from the threaded IRQ handler in the gp2ap020a00f driver, which queues data-work through the irqworkqueue. However, the freeirq function does not refresh the queued irwork, resulting in the work continuing to run...

CVE-2026-46331-pedit-cow

CVE-2026-46331-pedit-cow Write-up and exploitation steps for the pedit COW vulnerability CVE-2026-46331. Overview This challenge demonstrates pedit COW, a Linux kernel flaw in the traffic-control subsystem's packet-editing action actpedit. The vulnerability allows an unprivileged user to overwrit...

reproducer-poc-CVE-2022-0847

Naive detector and reproducer of CVE-2022-0847 dirty pipe. Uses simple generator of syscall sequences / programs from purposefully limited set of building blocks / input values only generation, no advanced fuzzing; no mutation; no coverage guidance; no shrinking / minimization and detects...

CVE-2022-1015

CVE-2022-1015 id uid=1000d gid=1000d groups=1000d ./poc + unshare done table created: leaktable chain created: leakchain rule added Listening on port 9999 table created: leaktable chain created: leakchain rule added Listening on port 9999 kerneladdress: ffffffffb4a00000 kernelstack:...

CVE-2019-2215

CVE-2019-2215 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1942 https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=414885 Samsung S7 and S7 Edge with Kernel 3.18.x seem not vulnerable could be however, with more work with PoC adjustments. Could not see more,...

linux-4.19.72_CVE-2020-29370

Linux kernel There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first. In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentatio...

CVE-2025-40019-Essiv

CVE-2025-40019-Essiv A PoC for CVE-2025-40019 in ESSIV module. exploit WIP for exploitation, note that scatterlist both req-src and req-dst has pagelink member. pagelink is a way to encode sg table info alongside page pointer as far as I understand: gdb ptype struct scatterlist type = struct...

SUSE CVE-2023-53579

In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: fix irq domain leak Uwe Kleine-König pointed out we still have one resource leak in the mvebu driver triggered on driver detach. Let's address it with a custom devm action...

SUSE CVE-2025-38093

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: x1e80100: Add GPU cooling Unlike the CPU, the GPU does not throttle its speed automatically when it reaches high temperatures. With certain high GPU loads it is possible to reach the critical hardware shutdown...

SUSE CVE-2025-38241

In the Linux kernel, the following vulnerability has been resolved: mm/shmem, swap: fix softlockup with mTHP swapin Following softlockup can be easily reproduced on my test machine with: echo always /sys/kernel/mm/transparenthugepage/hugepages-64kB/enabled swapon /dev/zram0 zram0 is a 48G swap...

SUSE CVE-2025-38596

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthorgemcreatewithhandle debugfs code The object is potentially already gone after the drmgemobjectput. In general the object should be fully constructed before calling drmgemhandlecreate, except the...