CVE-2024-38041

CVE-2024-38041 커널 포인터가 appid.sys 드라이버의 ioctl 0x22A014를 통해 출력 사용자 모드 버퍼에 복사됩니다...

iOS26.6-CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB 읽기 KASLR 무력화 구성 요소: AppleKeyStore 커널 확장 — LibSerSEPControlDeserialize 영향: iOS / iPadOS 26.6 23G71 및 이전 버전 수정 버전: iOS / iPadOS 26.6.1 23G83 유형: SEP 제어 메시지 역직렬화 과정의 Out-of-Bounds 읽기 영향: 커널 포인터 유출 → 샌드박스 및 자격entitlement 없는 프로세스에서 KASLR 무력화 DYLDINTERPOSE ACM 핸들 캡처 경...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB 읽기 KASLR 무력화 구성 요소: AppleKeyStore 커널 확장 — LibSerSEPControlDeserialize 영향: iOS / iPadOS 26.6 23G71 및 이전 버전 수정 버전: iOS / iPadOS 26.6.1 23G83 유형: SEP 제어 메시지 역직렬화 과정의 경계를 벗어난 읽기Out-of-Bounds read 영향: 커널 포인터 유출 → 샌드박스 및 자격entitlement이 없는 프로세스에서 KASLR 무력화 DYLDINTERPOS...

CVE-2026-20805-PoC

CVE-2026-20805 PoC Microsoft Desktop Window Managerdwm.exe의 정보 노출 취약점을 입증하는 개념 증명PoC입니다. 개요 이 저장소에는 Windows Desktop Window Manager 프로세스에 영향을 미치는 정보 노출 취약점인 CVE-2026-20805를 재현하기 위해 개발된 맞춤형 개념 증명PoC이 포함되어 있습니다. 이 취약점은 ALPC 관련 구조체의 부적절한 처리로 인해 로컬 인증 사용자가 커널 객체 포인터를 유출할 수 있게 하며, 잠재적으로 KASLR커널 주소 공간...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: 데스크톱 힙에 하나의 QWORD가 너무 많음 Windows 11 Insider 빌드 10.0.28020.2149에서 Win32k 데스크톱 힙의 사용자 모드 매핑이 오프셋 0x100에 원시 커널 세션 풀 포인터를 노출했습니다. 읽기 자체는 거의 공격적으로 작을 정도입니다: root@kitploit: ULONG64 leaked = ULONG64 desktopheap + 0x100; 테스트 세션에서 다음 값이 반환되었습니다: root@kitploit: 0xffffc600dcc00040 이 값은 동일한...

CVE-2026-74665

A flaw was found in the Linux kernel. Incorrect length accounting for skb socket buffer fragments after an eXpress Data Path XDP program adjusts the fragment area can lead to an out-of-bounds read. This allows an attacker to potentially disclose sensitive kernel pointers and corrupt user-space...

Astra Linux – Vulnerability in Linux 5.10

The checkaluop function in kernel/bpf/verifier.c in the Linux kernel, as of v5.16-rc5, did not properly update the bounds when handling the mov32 instruction. This issue allows local users to obtain potentially sensitive address information, also known as a “pointer leak.”...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed incorrect reg type conversion in releasereference Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release this memory by calling the corresponding helper...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: scsi: advansys: Fixed kernel pointer leaks Pointers should be printed using %p or %px, rather than being cast to unsigned long and then printed using %lx. Change %lx to %p when printing hashed pointers...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007loadencoder In go7007loadencoder, the variable bounce i.e., go-bootfw is allocated without subsequent deallocation. After the following call chain: saa7134go7007init | | - go7007bootencoder |...

SUSE CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

SUSE CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

AZL-97053 CVE-2026-74612 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

UBUNTU-CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

UBUNTU-CVE-2026-74612

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665

CVE-2026-74665 affects the Linux kernel 's generic XDP (eXpress Data Path) path. When an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len with the old fragment contribution. After a fragment shrink, skb_headlen() becomes larger than...

EUVD-2026-64352

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...