RingBufferDetonator

Ring Buffer Detonator This is a proof-of-concept program for triggering to prove a logic bug in rbpercpuempty. Programs hit the bug will be hung up in kernel-space busy deadloop in tracingreadpipe and impossible to suspend or terminate using any UNIX signal including SIGKILL. Despite exhibiting...

physmem

physmem physmem is a physical memory inspection tool and local privilege escalation targeting macOS up through 10.12.1. It exploits either CVE-2016-1825 or CVE-2016-7617 depending on the deployment target. These two vulnerabilities are nearly identical, and exploitation can be done exactly the...

wordpress-batch-rce-lab

wp2shell: WordPress Batch RCE A technical breakdown of CVE-2026-63030, a logic bug in WordPress core's REST API batch endpoint that lets an anonymous request dispatch under a different request's route and permission check, chaining into CVE-2026-60137 SQL injection for unauthenticated remote code...

check-cve-2026-23111

CVE-2026-23111 Defensive Validation Script Overview CVE-2026-23111 is a Linux kernel vulnerability in nftables that can be exploited for local privilege escalation by an unprivileged user on systems where user namespaces and nftables are available.12 Public vendor and government advisories descri...

CVE-2024-20674

CVE-2024-20674 This is my take at an exploit of the public CVE CVE-2024-20674 to achieve Kerberos mutual authentication bypass using a logic bug in the client-side handling of Kerberos U2U TGT-REP. This can be used for instance to serve arbitrary GPOs when spoofing the DC to a client, and take...

CVE-2026-0073-Android-client-TLS-auth-bypass

CVE‑2026‑0073 is a logic bug in Android’s ADB daemon adbd that allows an attacker to bypass TLS mutual authentication and open a remote shell on a device that has wireless debugging enabled and has been paired with any computer at least once. The root cause is a single misused API: the return val...

Linux-Kernel-Dirty-Pipe-Exploitation-Logic-Bug-

Linux Kernel Dirty Pipe Exploitation Logic Bug by: Antonius w1sdom https://www.bluedragonsec.com https://github.com/bluedragonsecurity Dirty Pipe CVE-2022-0847 is one of the most significant security vulnerabilities in Linux Kernel 5.8 – 5.15.24, discovered by Max Kellermann in 2022. This...

AZL-100121 CVE-2026-89773 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

DEBIAN-CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89773 drm/amd/display: Skip Update HDCP Config In Transition State

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip Update HDCP Config In Transition State Transition state does not have a valid dmstreamctx that should skip configuring HDCP routine. The routine is valid to go through only when a valid stream is created...

CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89748

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

ubuntu-cve-2026-31431-mitigation

Complete Guide to Updating the Kernel and kmod in Ubuntu to Fix Security Vulnerabilities CVE CVE-2026-31431 This vulnerability, also known as Copy Fail, is a logic bug in the Linux kernel that occurs in the AFALG / algifaead path. According to the discloser, an unprivileged local user can cause t...

CVE-2026-31431

Copy Fail CVE-2026-31431 - Comprehensive Writeup 1. Vulnerability Overview Vulnerability Name: Copy Fail CVE Identifier: CVE-2026-31431 Discovered By / Authors: Xint Code Research Team building upon initial foundational research by Theori researcher Taeyang Lee. "Copy Fail" is a critical logic...

TLPE

这是 CVE-2026-49881 的 PoC 和 writeup，该漏洞是 Android 17 Telecom 服务中 InCallController 类的一个逻辑问题，允许无特权的应用在无需额外用户交互的情况下，以 UID 1000 systemserver 的身份获得任意代码执行能力。我们在此还展示了，即使在现代 Android 版本中，systemserver 代码执行仍然可以轻松地用于获得持久化。 我于 2026-04-10 向 Android 安全团队报告了此漏洞，于 2026-05-06 被确认，并在 2026 年 9 月的 Android 安全公告中修复。（补丁见此处...

LSPromise

LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.13 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.13 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

EUVD-2026-71666

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856...

CVE-2026-80665 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-65915

A flaw was found in NLTK. A logic bug in the FileSystemPathPointer.open function allows the sandbox validation check to be bypassed. A remote attacker can exploit this by providing specially crafted file:// Uniform Resource Locators URLs to nltk.data.load. This enables the attacker to read...