CVE-2026-98252

The Linux kernel contains a reference count bug within the RDMA/core component, specifically in the iwpm_get_nlmsg_request() function. The root cause is that the refcount is initialized after the list_add_tail() operation, allowing another CPU to perform a kref_get() on a global list before initi...

EUVD-2026-92098

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105205 SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

cve-2016-0728-testbed

CVE-2016-0728 테스트베드 이 저장소는 Linux에서 발생하는 refcount 누수 및 오버플로우 버그인 CVE-2016-0728에 대한 테스트 프로그램을 포함하고 있으며, 이는 use-after-free로 이어집니다. 이 버그는 Perception Point에 의해 발견 및 설명되었습니다. 저는 그들과 관련이 없습니다. 사용법 Welcome to the CVE-2016-0728 testbed sizeofstruct msgmsg == 0x30, sizeofstruct key == 0xb8 PID: 27673, UID:...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

CVE-2025-21756

CVE-2025-21756 — Exploitation Lab 교육 및 승인된 보안 연구 목적으로만 사용하십시오. 설명 CVE-2025-21756은 2025년 2월 26일에 공개된 Linux 커널의 vsockVirtual Socket 서브시스템에서 발생하는 use-after-free UAF 취약점입니다. 이 취약점으로 인해 로컬 공격자가 영향을 받는 Linux 시스템에서 루트 권한 상승 을 할 수 있습니다. CVSS v3.1: 7.8 HIGH 벡터: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE:...

PinTheft-go

pintheft-go pintheft의 Go 포팅 - RDS zcopy double-free LPE. Dirty Frag 취약점 클래스에 속합니다. !IMPORTANT Arch Linux는 RDS 모듈이 기본적으로 로드될 수 있는 몇 안 되는 배포판 중 하나이므로, 이 취약점에 가장 많이 노출된 배포판 중 하나입니다. 작동 방식 요약 버그는 rdsmessagezcopyfromuser에 있습니다. 이 함수는 FOLLGET을 통해 사용자 페이지를 한 번에 하나씩 GUP-핀합니다. 이후 페이지에서 폴트가 발생하면예: PROTNONE...

cve-2024-1086-writeup

CVE-2024-1086 근본 원인 및 악용 대상 커널: Linux 6.8 netfilter nftables 새로운 관점: nftverdictinit의 논리 혼동으로 인해 refcount 이중 해제가 발생하며, 힙 스프레이를 통해 임의 메모리 쓰기로 악용 가능합니다. 목차 1. 배경 — netfilter / nftables 개요 2. 근본 원인 분석 — nftverdictinit 논리 혼동 3. 취약한 커널 코드 — 주석이 달린 소스 발췌 4. 개념 증명 — 트리거 및 악용 코드 5. 악용 전략 — 힙 스프레이를 통한 임의 쓰...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1742806909)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1742806909 advisory. - In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asixmdioread asixreadcmd may read le...

Rocky Linux 8 [CIQ] Security Update: python3-psutil / python3-psutil-debuginfo (crlsa-2021_4324)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214324 advisory. python-psutil: double free because of refcount mishandling CVE-2019-18874 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787305050)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787305050 advisory. - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a sessi...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787305050)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787305050 advisory. - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a...

CVE-2026-98163

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

CVE-2026-98163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

SUSE CVE-2026-93223

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the...

SUSE CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

DEBIAN-CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

AZL-104706 CVE-2026-98128 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

DEBIAN-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...