CVE-2026-53365

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK Zero-Copy Reference Count Underflow, Page-Cache Overwrite Privilege Escalation HackSpeak distribution mirror. This repository is a distribution mirror of MaherAzzouzi/vsockdrop , with code identical to upstream; upstream does not include a LICENSE, so...

VsockDrop-Adapted-CVE-2026-53365

VsockDrop-Adapted An adapted version of MaherAzzouzi's VsockDrop exploit for CVE-2026-53365, modified for reliability on busy systems where the original PoC's page reclaim race is unreliable. These modifications were written autonomously by an AI model during a penetration testing engagement. No...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

cve-2026-23111-poc

CVE-2026-23111 For more details, see notes.md Description CVE Description from NIST An inverted logical check in nftmapcatchallactivate causes nftchain-use reference count to not be restored when a DELSET operation is aborted. This allows triggering UAF, and can be abused to obtain local privileg...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

Linux Distros Unpatched Vulnerability : CVE-2026-125191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane captu...

CVE-2026-125191

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

UBUNTU-CVE-2026-125191

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-125191

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-125191 FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-125191 FFmpeg through 9.0.2 V4L2 M2M Decoder Deadlock via Reference Count Leak

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

EUVD-2026-120280

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

CVE-2026-125191

FFmpeg versions through 9.0.2 are vulnerable to a reference count leak located in libavcodec/v4l2_buffers.c. This flaw allows an attacker to deadlock the V4L2 mem2mem decoder when processing multi-plane capture formats. By supplying crafted H.264 , HEVC , or VP9 streams with resolution changes, a...

PT-2026-141019

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2 buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ff v4l2 m2m codec reinit wait forev...

CVE-2026-125191: FFmpeg: FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2_buffers.c that allows attackers to deadlock the…

FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l2buffers.c that allows attackers to deadlock the V4L2 mem2mem decoder on multi-plane capture formats. Attackers can supply crafted H.264, HEVC, or VP9 streams with resolution changes, making ffv4l2m2mcodecreinit wait forever an...

io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption holds skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking a device reference, such as vtircvcb...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget, which on success acquires a reference to the module. If any subsequent operation causes straceopen to fail, the reference count is decrement...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...