CVE-2026-53365

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK, underflow счётчика ссылок в zero-copy, повышение привилегий через перезапись Page-Cache Распространяемое зеркало HackSpeak. Этот репозиторий является распространяемым зеркалом MaherAzzouzi/vsockdrop , код идентичен апстриму; апстрим не включает LICENS...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

cve-2026-23111-poc

CVE-2026-23111 자세한 내용은 notes.md를 참조하세요. 설명 NIST의 CVE 설명 nftmapcatchallactivate 내의 반전된 논리 검사로 인해 DELSET 작업이 중단될 때 nftchain-use 참조 카운트가 복원되지 않습니다. 이로 인해 UAF가 트리거될 수 있으며, 로컬 권한 상승 을 얻는 데 악용될 수 있습니다. 이 버그는 커밋 1444ff890b4653add12f734ffeffc173d42862dd에서 수정되었습니다. 사전 요구 사항 Linux 커널 버전 6.12.69 이하에는 이 반전된...

CVE-2026-43494-PinTheft-PoC

SLEY — Preuve de concept PinTheft CVE-2026-43494 Preuve de concept — uid=1000raken → uid=0root après ./sley sur WSL2 6.6.87.2-microsoft-standard-WSL2 Preuve de concept en un seul fichier pour CVE-2026-43494 PinTheft : une escalade de privilèges locale du noyau Linux qui enchaîne un bug de comptag...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Preuve de concept — uid=1000raken → uid=0root après ./sley sur WSL2 6.6.87.2-microsoft-standard-WSL2 Fichier unique de preuve de concept pour CVE-2026-43494 PinTheft : une escalade de privilèges locale du noyau Linux qui enchaîne un bug de comptage de références...

Linux Distros Unpatched Vulnerability : CVE-2026-80642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while th...

UBUNTU-CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-80683

CVE-2026-80683 is a use-after-free vulnerability in the Linux kernel's Bluetooth SCO subsystem . The root cause is a reference-counting bug: the SCO socket stores a sco_conn pointer without holding its own reference. When a socket close() races the Bluetooth controller's Disconnection Complete ev...

CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-80642 liveupdate: Reference count incoming FLB data

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

EUVD-2026-67518

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-74735

A flaw was found in the Linux kernel's L2TP Layer 2 Tunneling Protocol implementation. A local user could trigger a reference count leak by closing specific /proc or /sys files related to L2TP tunnels and sessions before fully reading their content. This could lead to resource exhaustion,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098700 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the...

CVE-2026-74721

A flaw was found in the Linux kernel's accel/amxdna component. Specifically, an error in the amdxdnainsertpages function causes system resources to be released too early. This premature release can lead to a critical error when the system later attempts to free the same resources, resulting in a...

CVE-2026-74630

A flaw was found in the Linux kernel's IPv6 subsystem. The in6devget function can incorrectly increment the reference count of an inet6dev object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulti...

CVE-2026-74631

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...

CVE-2026-74695

A flaw was found in the Linux kernel's netfilter flow table. When processing network packets, a reference count leak can occur if a packet already has a destination entry and skbdstsetnoref is called. This issue can lead to a kernel warning, potentially causing system instability or a denial of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ext4: fixed the iloc.bh leak in ext4xattr inodeupdateref. The error branch of ext4xattr inodeupdateref forgot to release the refcount for iloc.bh. This issue was discovered during code review...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: netrom: Decreases the sock refcount when the sock timer expires. The commit 63346650c1a9 “netrom: switch to the sock timer API” switched to using the sock timer API. This replaced modtimer with skresettimer, and deltimer with...