VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

Linux Distros Unpatched Vulnerability : CVE-2026-89694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without...

Linux Distros Unpatched Vulnerability : CVE-2026-89663

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinne...

Linux Distros Unpatched Vulnerability : CVE-2026-89669

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linke...

CVE-2026-89694

A flaw was found in the Linux kernel's NFSv4.2 server nfsd. An authenticated NFSv4.2 client could exploit a vulnerability in the managecpntfstate function by guessing a state identifier. This improper ownership check allows the client to cancel and free another client's copy-notify stateid, leadi...

CVE-2026-89663

A flaw was found in the Linux kernel's Network File System Daemon nfsd. This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading t...

AZL-100175 CVE-2026-89694 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

DEBIAN-CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

AZL-100076 CVE-2026-89669 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89663

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

AZL-100871 CVE-2026-89663 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...

CVE-2026-89694

CVE-2026-89694 affects the Linux kernel NFS server (nfsd) on the OFFLOAD_CANCEL path. The function manage_cpntf_state() freed a target copy-notify state without verifying ownership. Because the lookup key (st->si_opaque.so_id) is allocated cyclically (guessable) and the embedded clientid is a ...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

EUVD-2026-76606

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid

In the Linux kernel, the following vulnerability has been resolved: nfsd: check client ownership when cancelling a copy-notify stateid On the OFFLOADCANCEL path clp != NULL, managecpntfstate freed the target cpntf state without checking ownership. The lookup key st-siopaque.soid is allocated...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...

CVE-2026-89669

CVE-2026-89669 is a use-after-free in the Linux kernel's nfsd (NFS server) component. The copy-notify state ID was published into the s2s_cp_stateids IDR before its cp_p_stateid/cp_p_clid fields were fully initialized. A racing OFFLOAD_CANCEL with a crafted client ID and guessable sequence number...

EUVD-2026-76581

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...