PinTheft-go

pintheft-go Go port of pintheft - RDS zcopy double-free LPE. Member of the Dirty Frag vulnerability class. !IMPORTANT Arch Linux is one of the most exposed distributions for this vulnerability, as it is among the few where the RDS module can typically be loaded by default. How it works tl;dr The...

CVE-2025-21756

CVE-2025-21756 — Exploitation Lab For educational and authorized security research purposes only. Description CVE-2025-21756 is a use-after-free UAF vulnerability in the Linux kernel's vsock Virtual Socket subsystem, disclosed on February 26, 2025. It allows a local attacker to escalate privilege...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...

cve-2024-1086-writeup

CVE-2024-1086 Root Cause & Exploitation Target kernels: Linux 6.8 netfilter nftables Novel angle: Logic confusion in nftverdictinit causes refcount double-free, exploitable via heap spray to arbitrary memory write. Table of Contents 1. Background — netfilter / nftables overview 2. Root Cause...

CVE-2023-20938-poc

CVE-2023-20938 — Android binder UAF privilege escalation A local privilege escalation proof-of-concept for CVE-2023-20938 , a use-after-free in the Android binder driver. From an unprivileged shell it gains uid 0 and drops SELinux to permissive , then spawns a root shell. Target for this build:...

SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24662-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24662-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: -...

SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24651-1)

The remote SUSE Linux SLES16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24651-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-31708:...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...

cve-2016-0728-testbed

CVE-2016-0728 testbed This repository contains a test program for CVE-2016-0728, a refcount leak and overflow bug in Linux, that leads to a use-after-free. The bug was found and explained by Perception Point. I am not affiliated to them. Usage Welcome to the CVE-2016-0728 testbed sizeofstruct...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151145 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: smb: Client: Fixed the issue where a busy dentry warning would occur after unmount after DIO. The commit c68337442f03 “cifs: Fixed the issue where deferred dentry references were not released after unmount” addressed the issue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: The pin mechanism for the upper rpcclnt across the TLS-connected connectworker. The TLS connection process involves a use-after-free: Nothing pinning the upper rpcclnt occurs during the delayed connectworker. The xsconnec...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind llcuiautobind opens a SAP after choosing a dynamic LSAP. llcsapopen returns a reference owned by the caller, and llcsapaddsocket takes a second reference for the socket’s membership in...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ASoC: hdachda: Fix hlink refcount leak on component registration failure hdachdadevprobe obtains the HDA link using sndhdacextbuslinkget prior to registering the ASoC component. If component registration fails, the function retur...

Astra Linux – vulnerability in linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmiallocrecvmsguser takes the temporary user reference owned by the receive message, and ipmifreerecvmsg drops it again. If event delivery fails after allocating receive messag...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net: watchdog: fix refcount tracking races The blame commit converted the untracked devhold/devput calls in the watchdog code to use the tracked devholdtrack/devputtrack functions which were later renamed/interfaced to netdevhold...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers The association or transport reference must be held before rearming a timer within the timer handlers. The existing code calls modtimer before acquiring the reference...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: fix refcount leak in isfullcharged In isfullcharged, powersupplygetbyname is called to obtain a reference to the fuelgauge power supply. If the voltage check uV = desc-fullbattuV succeeds, the...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes the refcount after listaddtail, making it accessible to a global list where another CPU can perform krefget on nlmsgrequest, resulting in a...

kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path

A flaw was found in the Linux kernel's NVMe over TCP target nvmet-tcp implementation. When a data digest mismatch is detected, nvmetrequninit is called unconditionally, but if the command was already in the INITFAILED state, the matching percpureftrygetlive was never performed. The resulting...