cve-2023-6931-pipa

CVE-2023-6931 — Xiaomi Pad 6 pipa Privilege Escalation and Disabling SELinux The final version of the exploit used on the device, organized separately in this directory. Target Device Xiaomi Pad 6 / pipa / SM8250 System HyperOS OS2.0.20.0.UMZCNXM Kernel 4.19.157-perf-g240e1d0a5f52 Start adb shell...

CVE-2026-98937

CVE-2026-98937 — perf kernel callchain permission bypass English | 简体中文 Linux perf/core permission-check bypass: an unprivileged task can request kernel callchains while setting excludekernel=1, skipping the perfallowkernel gate and disclosing kernel stack frames through the perf ring buffer. Thi...

kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap()

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap revival and the last munmap operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: perf/dwcpcie: fixed duplicate PCIDEV devices. During the platformdeviceregister function, the incorrect use of structdevice as platformdata resulted in a kmemdup operation on the PCIDEV structure. Even worse, accessing the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling BRS and Last Branch Record LBR are mutually exclusive hardware features, and users of both are tracked via cpuc-lbrusers. When SVM is toggled on for a...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fslembpmudel fslembpmudel unconditionally calls putcpuvarcpuhwevents at the ‘out:’ label, but only calls the matching getcpuvar after the ‘i hw.idx is negative, the function jumps to...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode When attempting to run both perf mode and sysfs mode simultaneously, the WARNON in tmcetrenablehw is triggered occasionally: WARNING: CPU: 42 PID: 3911571 at...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perfgroupdetach handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their groupleader...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace; however, it is never set by the BRBE driver. It should be zero-initialized as per the...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leaks in LBR stack Prior to Arch LBR gaining CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793786843)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793786843 advisory. - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmiencdec: Restrict string length in decode The QMI...

MiracleLinux 9 : kernel-5.14.0-687.53.1.el9_8 (AXSA:2026-2240:115)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2240:115 advisory. kernel: ext4: fix e4b bitmap inconsistency reports CVE-2026-45942 kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGESIZE...

PT-2026-135525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds memory access exists in the tracing filter parser. A local user with perf access can read and corrupt kernel memory by providing a crafted tracepoint filter expression...

CVE-2026-89984

A flaw was found in the Linux kernel's perf/x86/intel component. Insufficient validation of privilege levels in the Last Branch Record LBR stack allows a local attacker to expose kernel branch records to user space. This information disclosure vulnerability can lead to kernel addresses appearing ...

Exploit for CVE-2026-98937

CVE-2026-98937 — perf kernel callchain permission bypass Engl...

CVE-2026-98937

A flaw was found in the Linux kernel's Performance Events perf subsystem. The kernel failed to enforce proper privilege checks when capturing kernel callchains call stack traces. A local unprivileged user could exploit this vulnerability to bypass profiling restrictions and collect kernel call...

CVE-2026-99187

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...