CVE-2026-92495

CVE-2026-92495 affects the Linux kernel RDMA/bnxt_re driver . The function bnxt_re_mmap() rejects VM_WRITE for DBR_PAGE and TOGGLE_PAGE mappings, but a read-only mapping can still retain VM_MAYWRITE, allowing it to later be upgraded via mprotect(PROT_WRITE). This bypasses the write-permission che...

EUVD-2026-82116

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

CVE-2021-28663

CVE-2021-28663 Una fuga PoC básica para CVE-2021-28663 Detalles internos de la vulnerabilidad de puerta trasera del kernel de Android Esta es una PoC básica para CVE-2021-28663. Un fallo de diseño en el controlador del kernel de GPU Mali para Android. 1. Crear un GPUVA y también hacer mmap para...

UBUNTU-CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

cve-2018-17182

define GNUSOURCE include include include include include include include include include include include int vmaspamcontrolfd = -1; int threaddonefd = -1; int vmaspamdonefd = -1; void semincint fd uint64t val = 1; if writefd, &val, 8 != 8 err1, "seminc"; void semdecint fd uint64t val; if readfd,...

CVE-2026-89791

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89791 perf: Fix use-after-free when perf mmap() revival races with the last munmap()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap revival races with the last munmap perfmmapclose drops rb-mmapcount without holding event-mmapmutex the refcountdecandtest right before the refcountdecandmutexlock of event-mmapcount. A...

CVE-2026-89791

CVE-2026-89791 is a use-after-free race condition in the Linux kernel's perf subsystem . The root cause is that perf_mmap_close() drops rb->mmap_count without holding event->mmap_mutex, allowing a concurrent perf_mmap_rb() revival path to free a newly allocated ring buffer that another proc...

Dirty-COW-CVE-2016-5195-

Dirtyc0w Docker POC（概念验证） 前置条件： 已安装 Vagrant 使用方法 首先克隆项目 git clone https://github.com/BrolyCode/Dirty-Cow.git 进入文件夹 cd Dirty-Cow 然后使用以下命令启动环境 root@kitploit: vagrant up 服务器构建完成后，通过 SSH 登录 root@kitploit: vagrant ssh 切换到 root 用户 root@kitploit: sudo -i 现在我们可以以黑客身份登录 root@kitploit: docker exec -it -u...

dyen

dyen dyen 使用 macOS 自带的 Python 在内存中加载 Mach-O dylib，并在不调用 dlopen 的情况下调用该 dylib 的导出入口点。其目标是使映像永远不会以独立文件的形式出现在目标上，也永远不会注册到 dyld。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/dyen Summary dyen 是一个仅使用标准库的 Mach-O 内存加载器（loader.py），适用于 macOS 上自带的 /usr/bin/python3。它读取普通...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

kernel: selinux: fix overlayfs mmap() and mprotect() access checks

A flaw was found in the Linux kernel's SELinux security module when handling overlayfs. The existing security model for overlayfs does not properly enforce access controls for mmap and mprotect operations. This oversight could allow a local attacker to bypass intended security policies, potential...

android-CVE-2016-5195

CVE-2016-5195 CVE-2016-5195（dirty cow/dirtycow/dirtyc0w）针对 Android 的概念验证 此仓库演示了通过 ADB 连接的存在漏洞的 Android 设备上的该漏洞。 它不会禁用 SELinux（参见 https://github.com/timwr/CVE-2016-5195/issues/9），也不会在设备上安装超级用户。 root@kitploit: $ make root ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPPLATFORM=android-16...

CVE-2016-5195

demo1 此演示基于 https://github.com/timwr/CVE-2016-5195 make test 输出： root@kitploit: user@user:/$ cd /home/user/demo1 && make test /home/user/adb/android-ndk-r21d/ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk APPABI=x8664 APPPLATFORM=android-23 make1: Entering directory '/home/user/demo1' x86...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF: Avoid holding the freezemutex during the mmap operation. We use the map-freezemutex to prevent race conditions between the mapfreeze function and memory mapping operations with writable permissions. The way we currently hand...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fixed AUX buffer serialization. Ole reported that the event-mmapmutex is strictly insufficient to serialize the AUX buffer. To serialize it properly, a per-RB mutex should be added...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fixed the issue where the mmap write lock was not released. If the mmap write lock is acquired while draining a retry fault, the mmap write lock is not released because svmrangerestorepages calls mmapreadunlock before...

CVE-2016-5195-master

CVE-2016-5195 CVE-2016-5195 dirty cow/dirtycow/dirtyc0w 针对 Android 的概念验证代码 此仓库演示了在通过 ADB 连接的存在漏洞的 Android 设备上利用该漏洞的过程。 它不会禁用 SELinux（参见 https://github.com/timwr/CVE-2016-5195/issues/9），也不会在设备上安装超级用户权限。 root@kitploit: $ make root ndk-build NDKPROJECTPATH=. APPBUILDSCRIPT=./Android.mk...

CVE-2024-44947

CVE-2024-44947 描述 ： 在Linux内核中，已修复以下漏洞：fuse: 在设置页面为最新状态之前初始化超过EOF的页面内容。与fusedoreadpage不同，fusenotifystore 不会启用页面归零（因为它可用于更改部分页面内容）。因此，fusenotifystore 必须更加小心地在将页面标记为最新状态之前完全初始化页面内容（包括超过文件末尾的页面部分）。当前的代码可能会使超过文件末尾的页面内容未初始化，从而通过mmap...

Linux Distros Unpatched Vulnerability : CVE-2026-89772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: write-protect folios during data writeback commit 095be159f3eb btrfs: unify folio dirty flag clearing replaced the foliocleardirtyforio call in...