CVE-2026-92505

A flaw was found in the Linux kernel's iommu/amd component, specifically within the devidwrite debugfs function. When the foreachpcisegment loop fails to find a matching segment, a pointer can reference an invalid memory location. Accessing this invalid memory can lead to undefined behavior,...

CVE-2026-90391

A flaw was found in the Linux kernel. A local user could exploit a vulnerability in the dmirrorfault function. When a mirrored memory management mm structure has exited, dmirrorfault incorrectly returns a success code, causing the caller to enter an infinite retry loop. This can lead to a Denial ...

CVE-2026-90387

A flaw was found in the swiotlb component of the Linux kernel. When CONFIGDMADIRECTREMAP is enabled, the swiotlbinitiotlbpool function incorrectly reconstructs the virtual address for dynamic memory pools. This error causes swiotlbfreetlb to fail in recognizing allocated memory chunks, potentiall...

CVE-2026-98483

A flaw was found in the Linux kernel's Near Field Communication NFC subsystem. A reference counting error in the nfcgetlocalgeneralbytes function causes memory to be freed prematurely while callers still access the returned pointer. A local attacker could exploit this use-after-free vulnerability...

CVE-2026-93047

A flaw was found in the drm/v3d component of the Linux kernel. An implicit synchronization issue in the v3dsubmitlockreservations function could lead to a job reading a Buffer Object BO while another process is still writing to it. This could result in data corruption. A local attacker could...

CVE-2026-93046

A flaw was found in the Linux kernel's software node component. A local attacker could exploit a failing bounds check in the softwarenodegetreferenceargs function when an index of UINTMAX is passed. This could lead to an out-of-bounds access in the property array, potentially resulting in memory...

CVE-2026-93045

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF arena component. The bpfarenafreepages function incorrectly handles scalar arena addresses. When a scalar value is below the arena base, it can lead to an out-of-range memory offset. This issue could allow a local attacker to reuse...

CVE-2026-93041

A flaw was found in the Linux kernel's dw-edma component. A race condition exists where the dwedmaabortinterrupt function prematurely releases a lock, allowing the issuepending function to access outdated Direct Memory Access DMA channel status information. This can lead to new DMA descriptors...

CVE-2025-55752

🚨🚨 CVE-2025-55752 — Apache Tomcat: Directory-protection bypass via Rewrite Valve → PUT-based RCE🚨🚨 Summary CVE-2025-55752 is a security regression in Apache Tomcat introduced while fixing bug 60013. When the Rewrite Valve is used, Tomcat applies path normalization before URL decoding. This...

CVE-2026-93042

A flaw was found in the Linux kernel's dmaengine: dw-edma component. This vulnerability occurs because the dw-edma driver incorrectly calls a callback function after a Direct Memory Access DMA descriptor has been terminated. This can lead to a use-after-free condition, where the system attempts t...

CVE-2026-93037

A flaw was found in the Linux kernel's RDMA/hfi1 component. The settxreqheaderahg function fails to properly handle errors returned by sdmatxinitahg. This oversight allows the system to continue processing requests as if they were successfully initialized, even when an error occurred. This could...

CVE-2026-31431-Copy-Fail---Minified-LPE-PoC

CVE-2026-31431-CopyFail---Minified-LPE-PoC ⚠️ Disclaimer For Educational and Authorized Security Testing Purposes Only. This Proof-of-Concept PoC was synthesized for authorized Red Team emulation and vulnerability auditing. The authors and contributors assume no liability for the misuse of this...

CVE-2026-92513

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access manaib component. The manatablestoreudqp function can incorrectly manage queue pair QP references during partial table insertions. This can lead to a use-after-free vulnerability, where a freed memory region is accessed,...

CVE-2026-92510

A flaw was found in the Linux kernel. When a Shared Receive Queue SRQ is accessed via the netlink path, the rdmarestrackdel function is called too late during the ibdestroysrquser process. This timing issue can lead to a use-after-free vulnerability, where previously freed memory resources might...

CVE-2026-92509

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. When a counter is accessed via the netlink path, the rdmarestrackdel function is invoked too late during the counterrelease process. This timing issue can lead to a use-after-free vulnerability, where...

CVE-2026-92507

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access core component. A synchronization issue in the ibdeallocpduser function, when a Protection Domain PD is accessed via the netlink path, can lead to a use-after-free vulnerability. This could allow a local attacker to potential...

CVE-2026-92499

A flaw was found in the Linux kernel's ext4 filesystem. A local attacker with the ability to create or manipulate a corrupted directory can trigger a use-after-free vulnerability. This occurs when the ext4readdir function attempts to read directory entries from an invalid offset, leading to an...

CVE-2026-92496

A flaw was found in the ath11k Wi-Fi driver in the Linux kernel. This vulnerability allows a buffer overread to occur in the ath11kwmitlvoprx function. The driver reads the firmware buffer without adequately verifying its size, which could lead to reading data beyond the allocated memory. This...

CVE-2026-92491

A flaw was found in the Linux kernel's ARM System Control and Management Interface SCMI firmware. During the registration of protocol tables, the scmiprotocoltableregister function may fail to properly unregister previous requests if a subsequent entry fails. This can result in a dangling pointer...

CVE-2026-92489

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability occurs in the xfrmdevdirectoutput function due to incorrect handling of network packet buffer skb ownership. When netfilter drops a packet, the skb can be freed twice, leading to a double-free condition. This memory...