CVE-2023-20938

CVE-2023-20938 English 脆弱性解析 1. クライアントAとクライアントBは、コンテキストマネージャーservicemanagerを介してBinder接続を確立する 2. Aがノード0xbeefを作成（node = bindernewnodeproc, fp;）、Bはref-targetnodeを介してnode 0xbeefを参照する 3. Bがまずtargetnode 0xbeefを正しく処理し、targetnode...

CVE-2026-93181

CVE-2026-93181 affects the Linux kernel in the perf/x86/intel/uncore subsystem. The root cause is an incorrect call ordering: in the CPU online path, uncore_box_ref() was invoked before uncore_change_context(), so the gate on box->cpu >= 0 always failed and the uncore box was never initiali...

CVE-2026-89841 f2fs: only redirty pinned folios in redirty_blocks

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 LinuxカーネルにおけるRDS + iouring ページキャッシュオーバーライトによるローカル権限昇格 📌 概要 PinTheft は、LinuxカーネルのReliable Datagram Sockets RDSサブシステムにおける参照カウントバグであるCVE-2026-43494 のための高度なローカルルートエクスプロイトです。 RDSのゼロコピーパスにおけるダブルフリーとiouringの固定バッファを組み合わせることで、このエクスプロイトはSUIDルートバイナリの信頼性の高いページキャッシュオーバーライト...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fixed potential use after free in efcnportvportdel The krefput function will call nport-release if the reference count drops to zero. The nport-release function is efcnportfree, which frees the “nport” object...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between the async notify and socket close operations. The thread that submitted the request the one that called recvmsg/sendmsg may exit as soon as the async crypto handler’s complete function is...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: fix UAF in tegraslinkremove After calling spiunregistermaster, the refcount of the master will decrease to 0, and it will be freed in spicontrollerrelease. The device data will also be freed, which can lead to...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC（CVE-2026-43494） 概念验证 — 在 WSL2（6.6.87.2-microsoft-standard-WSL2）上执行 ./sley 后 uid=1000raken → uid=0root 面向 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一种 Linux 内核本地权限提升漏洞，它将 RDS zerocopy 引用计数缺陷 与 iouring 固定缓冲区 串联利用，以覆写 SUID root 二进制文件的页缓存。 免责声明： 本仓库仅用于经授权的安全研究、教学与防御性测试...

Linux Distros Unpatched Vulnerability : CVE-2026-89536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the...

AZL-100259 CVE-2026-89750 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89710

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfslayoutprocess forget path When the server returns a new layout stateid while a valid one is still held, pnfslayoutprocess calls pnfsmarkmatchinglsegsreturn on the on-stack freeme list a...

AZL-100325 CVE-2026-89697 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fhwantwrite for early-verified SETATTR in nfsdprocsetattr The BOTHTIMESET branch calls fhverify early so setattrprepare can inspect the dentry. This causes nfsdsetattr to skip fhwantwrite, so notifychange runs without a...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

UBUNTU-CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89504

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

UBUNTU-CVE-2026-89504

In the Linux kernel, the following vulnerability has been resolved: regulator: as3722getregulatordtdata: fix premature ofnodeput leaving dangling ofnode pointer In as3722getregulatordtdata, ofgetchildbyname acquires a reference on np, which is then assigned to pdev-dev.ofnode. The function...

CVE-2026-89750 tracing/user_events: Clear copied tracing state before fork duplication

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Clear copied tracing state before fork duplication duptaskstruct copies usereventmm from the parent into the child, without grabbing a reference to it. usereventmmdup should replace it, but it leaves that copi...

CVE-2026-89663 nfsd: revoke copy-notify stateids before dropping their reference

In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2scpstateids IDR and on their parent stid's sccplist, pinned by a single membership reference. freecpntfstatelocked only unlinks ...