CVE-2023-20938-poc

CVE-2023-20938 — Escalada de privilegios UAF en binder de Android Una prueba de concepto de escalada de privilegios local para CVE-2023-20938 , un uso después de liberación use-after-free en el driver binder de Android. Desde un shell sin privilegios obtiene uid 0 y establece SELinux a permisivo ...

CVE-2025-21756

CVE-2025-21756 — Laboratorio de explotación Solo para fines educativos y de investigación de seguridad autorizada. Descripción CVE-2025-21756 es una vulnerabilidad de use-after-free UAF en el subsistema vsock Virtual Socket del kernel de Linux, divulgada el 26 de febrero de 2025. Permite a un...

PinTheft-go

pintheft-go Port a Go de pintheft - LPE de double-free en zcopy de RDS. Miembro de la clase de vulnerabilidad Dirty Frag. !IMPORTANT Arch Linux es una de las distribuciones más expuestas a esta vulnerabilidad, ya que se encuentra entre las pocas donde el módulo RDS normalmente puede cargarse por...

cve-2024-1086-writeup

CVE-2024-1086 Causa Raíz y Explotación Kernels objetivo: Linux 6.8 netfilter nftables Ángulo novedoso: Confusión lógica en nftverdictinit provoca un double-free de refcount, explotable mediante heap spray para escritura arbitraria de memoria. Tabla de contenidos 1. Antecedentes — visión general d...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1742806909)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1742806909 advisory. - In the Linux kernel, the following vulnerability has been resolved: asix: fix uninit-value in asixmdioread asixreadcmd may read le...

Rocky Linux 8 [CIQ] Security Update: python3-psutil / python3-psutil-debuginfo (crlsa-2021_4324)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214324 advisory. python-psutil: double free because of refcount mishandling CVE-2019-18874 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787305050)

"The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787305050 advisory. - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a sessi...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787305050)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787305050 advisory. - In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a...

cve-2016-0728-testbed

Banco de pruebas CVE-2016-0728 Este repositorio contiene un programa de prueba para CVE-2016-0728, un fallo de fuga de contador de referencias refcount leak y desbordamiento en Linux que conduce a un use-after-free. El fallo fue encontrado y explicado por Perception Point. No estoy afiliado a...

CVE-2026-98163

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

CVE-2026-98163: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea "cgroup: Move dyingtasks cleanup from cgrouptaskrelease to cgrouptaskfree" extended the lifetime of tasks on the dyingtasks list. The iterators ha...

SUSE CVE-2026-93223

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput on VIP parse errors tegravipchannelofparse initializes np from dev-ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the...

SUSE CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

DEBIAN-CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

AZL-104706 CVE-2026-98128 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

DEBIAN-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

AZL-104327 CVE-2026-97556 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

AZL-104543 CVE-2026-97557 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97556

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...