docker_cve-2015-2925

Docker + CVE-2015-2925 = escaping from --volume Recent vulnerability in Linux known for about half of the year several months publicly made it possible to escape from bind mounts. In particular in case of Docker it's possible to escape from inside the directory mounted via --volume option to the...

CVE-2025-9074

CVE-2025-9074 – Docker Desktop Windows Container→Host Write via Exposed Engine API Author: w01f Status: Proof-of-Concept educational / authorized testing only Overview This project demonstrates a PoC for CVE-2025-9074 , a misconfiguration/exposure in certain versions of Docker Desktop for Windows...

airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

CVE-2023-0386-libs

Install compilation environment sudo apt install -y gcc libfuse-dev pkg-config Compile exploit gcc -Wall CVE-2023-0386.c pkg-config fuse --cflags --libs -DFILEOFFSETBITS=64 -o CVE-2023-0386-exp -static -lfuse Generate shellcode msfvenom -p linux/x86/exec CMD=/bin/sh PrependSetuid=True -f elf -o...

CVE-2023-0386

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalat...

CVE-2026-98996

The Linux kernel contains a vulnerability in the propagate_mount_busy() helper function, which fails to correctly identify busy mounts during synchronous unmounting. Due to a logic mismatch with the propagate_umount() function, the kernel may skip reference checks on mount copies that have two or...

EUVD-2026-108790

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98993

The Linux kernel contains a vulnerability where clone_mnt() improperly copies the MNT_UMOUNT flag because it only masks MNT_INTERNAL_FLAGS . When a mount is lazily unmounted but kept alive by a file descriptor, it can be copied into a new namespace while retaining the MNT_UMOUNT flag. This leads ...

EUVD-2026-108787

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98992

The Linux kernel contains a vulnerability in may_copy_tree() where it fails to stop walking an unmounted mount tree. Specifically, when dealing with nsfs or pidfs mounts that are lazily unmounted but kept alive by a file descriptor, recursive operations using MS_REC or AT_RECURSIVE continue to co...

EUVD-2026-108786

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98991

The Linux kernel is affected by a vulnerability where the mnt_notify_add() function fails to check if a mount is already present on the notify_list. Due to specific interactions between propagate_umount(), shrink_submounts(), and mark_mounts_for_expiry() under a single namespace_sem hold, a mount...

EUVD-2026-108785

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98989

The Linux kernel contains a vulnerability where the do_loopback() function fails to properly check for recursive bind mount loops when using the MS_REC flag. Specifically, while it checks the starting dentry, it allows the copying of mount namespace files from other namespaces. This allows an att...

EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98988

The Linux kernel contains a vulnerability in the open_tree(OPEN_TREE_NAMESPACE) function where covered mounts are incorrectly exposed in a new mount namespace. When an unprivileged user creates a new user namespace and calls open_tree, the resulting namespace fails to hide content that was previo...

EUVD-2026-108782

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

CVE-2026-98987

The Linux kernel contains a vulnerability where the attach_recursive_mnt() function fails to inspect the topmost mount of a source chain for a mount namespace file. This oversight causes mnt_change_mountpoint() to incorrectly attach existing mounts below the root of the mount namespace file as a ...

EUVD-2026-108781

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-98986

The Linux kernel contains a vulnerability where fsnotify marks of a mount namespace are removed from an RCU softirq context instead of a process context. This occurs because mnt_ns_tree_remove() hands a reference to call_rcu(), causing fsnotify_mntns_delete() to trigger a BUG by calling a sleepin...