CVE-2026-80695

In the Linux kernel, the following vulnerability has been resolved: hwmon: sht3x Fix unaligned accesses Sashiko reports: In sht3xupdateclient, the 16-bit temperature and humidity values are extracted from a stack-allocated byte array using be16tocpup. The pointers passed to this function are...

CVE-2026-80669

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable xfrmdecodesession hook attachment BPF LSM programs can currently attach to xfrmdecodesession. That hook may return an error, but securityskbclassifyflow calls it from a void path and triggers BUGON if an error is...

CVE-2026-80644

In the Linux kernel, the following vulnerability has been resolved: ocfs2: don't BUGON an invalid journal dinode BUG A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in...

CVE-2026-80638

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2removerefcountextent BUG Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. CAUSE When the last leaf block is removed fro...

CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-80625

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit during driver removal, and then is allocated again in...

CVE-2026-80604

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hidgetreport for numbered reports When a caller passes a size of 0 to hidreportrawevent for a numbered report, the function originally called hidgetreport before performing any size validation. Inside...

CVE-2026-80695

This vulnerability affects the sht3x hardware monitor (hwmon) driver in the Linux kernel . In sht3x_update_client(), 16-bit temperature and humidity values are read from a stack-allocated byte array using be16_to_cpup(). The pointers passed are buf and buf + 3; because the offset between them is ...

CVE-2026-80669

This Linux kernel vulnerability affects the interaction between BPF LSM programs and the xfrm_decode_session() hook. BPF LSM programs can attach to this hook, which may return an error. However, security_skb_classify_flow() invokes the hook from a void path and triggers a BUG_ON() if an error is ...

CVE-2026-80639

CVE-2026-80639 affects the Linux kernel 's cxl/test module (loaded as cxl_translate). The issue is in setup_xor_mapping(), where the Fortify overflow detector reported a potential 32-byte write to a zero-size buffer for the xormaps array, due to the __counted_by(nr_maps) annotation seeing nr_maps...

CVE-2026-80638

CVE-2026-80638 is an out-of-bounds write in the Linux kernel's ocfs2 (Oracle Cluster File System 2) subsystem, specifically in ocfs2_remove_refcount_extent() . When the last leaf block is removed from a refcount tree, the function converts the root back to leaf mode via a bulk memset on &rb->r...

CVE-2026-80625

CVE-2026-80625 affects the Linux kernel in the RDMA/hns driver. In a corner case of concurrent driver removal and driver reset , a bonding resource is first released in hns_roce_hw_v2_exit() and then re-allocated in hns_roce_register_device(), but the release timing has already passed. This cause...

CVE-2026-80604

CVE-2026-80604 is an out-of-bounds read in the Linux kernel's HID core subsystem. When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function invokes hid_get_report() before performing any size validation. Inside hid_get_report(), if the report is numbered (repo...

CVE-2026-80590

CVE-2026-80590 is a Linux kernel local denial-of-service vulnerability in the inet fragment reassembly path. When a virtio_net_hdr (via tun/tap or AF_PACKET with PACKET_VNET_HDR) marks an IPv4 or IPv6 fragment as GSO, the reassembled skb retains stale GSO state. The next segmentation point (e.g.,...

CVE-2022-36946

CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...

cve-2021-34558

PoC para CVE-2021-34558 root@kitploit: Run the malicious TLS server go run main.go -mode server Run a normal http.Get client call against the server which panics go run main.go -mode client Hay una modificación menor en ./vendor/github.com/refraction-networking/utls/handshakeserver.go para permit...

CVE-2019-14041

CVE-2019-14041 Codice proof-of-concept per CVE-2019-14041 Maggiori dettagli sulla vulnerabilità sono disponibili nel post del blog. Se hai domande, sei libero di scrivermi in DM su Twitter @tamirzb. Build ed esecuzione Per compilare, esegui ndk-build dell'Android NDK. Per eseguire il PoC,...

CVE-2019-14040

CVE-2019-14040 Codice proof-of-concept per CVE-2019-14040 Maggiori dettagli sulla vulnerabilità sono disponibili nel post del blog. Se hai domande, puoi scrivermi su Twitter @tamirzb. Build & Esecuzione Per compilare, esegui ndk-build dell'Android NDK. Per eseguire il PoC, esegui il binario usand...

CVE-2024-27804

CVE-2024-27804 root@kitploit: ./build.sh ./panic.sh root@kitploit: paniccpu 4 caller 0xfffffe0026851cdc: Unaligned kernel data abort. at pc 0xfffffe0026aed514, lr 0xfffffe0026aed5d8 saved state: 0xfffffe3a396e3200 x0: 0x000000000000000e x1: 0xfffffe1002bdc01b x2: 0x0000000000000000 x3:...

RowHammer-Exploit

RowHammer-Exploit RowHammer Based-Exploit Hintertür für syssuid mithilfe von Rowhammer Muss noch überarbeitet werden... herausfinden, warum Dinge nicht richtig funktionieren... root@kitploit: Current stage... Denial fails with the following stack trace... UG: unable to handle kernel paging reques...