CVE-2023-20938

CVE-2023-20938 English 漏洞分析 1. client A与client B通过上下文管理器servicemanager建立Binder连接 2. A创建node 0xbeefnode = bindernewnodeproc, fp;，B通过ref-targetnode引用node 0xbeef 3. B先正确处理targetnode 0xbeef，将引用了targetnode 0xbeef的事物bindertransaction存入A的事物队列binderenqueueworkilocked&t-work, &proc-todo;，使A可以再次引用被释放的悬挂指针 ...

CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 LinuxカーネルにおけるRDS + iouring ページキャッシュオーバーライトによるローカル権限昇格 📌 概要 PinTheft は、LinuxカーネルのReliable Datagram Sockets RDSサブシステムにおける参照カウントバグであるCVE-2026-43494 のための高度なローカルルートエクスプロイトです。 RDSのゼロコピーパスにおけるダブルフリーとiouringの固定バッファを組み合わせることで、このエクスプロイトはSUIDルートバイナリの信頼性の高いページキャッシュオーバーライト...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fixed potential use after free in efcnportvportdel The krefput function will call nport-release if the reference count drops to zero. The nport-release function is efcnportfree, which frees the “nport” object...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: fix UAF in tegraslinkremove After calling spiunregistermaster, the refcount of the master will decrease to 0, and it will be freed in spicontrollerrelease. The device data will also be freed, which can lead to...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC（CVE-2026-43494） 概念验证 — 在 WSL2（6.6.87.2-microsoft-standard-WSL2）上执行 ./sley 后 uid=1000raken → uid=0root 面向 CVE-2026-43494 （ PinTheft ）的单文件概念验证：一种 Linux 内核本地权限提升漏洞，它将 RDS zerocopy 引用计数缺陷 与 iouring 固定缓冲区 串联利用，以覆写 SUID root 二进制文件的页缓存。 免责声明： 本仓库仅用于经授权的安全研究、教学与防御性测试...

CVE-2026-97946

A flaw was found in the Linux kernel. Improper reference counting during AMD PCI root device initialization and caching in the amdsmninit function fails to properly track device lifecycles. Under certain conditions, this flaw may allow a local attacker to cause a Denial of Service DoS or system...

CVE-2026-93795

A flaw was found in the Linux kernel's block control group blk-cgroup subsystem, which can lead to a Denial of Service DoS. When an insertion failure occurs during the creation of a block group structure, the error-handling path fails to properly shut down reference counting. A local user can...

UBUNTU-CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946

The Linux kernel contains a flaw in the x86/amd_node architecture involving incorrect PCI device reference counting within the amd_smn_init() function. The issue stems from a local "root" pointer used as a temporary variable during device searching, where refcounts related to search iterators wer...

CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

PT-2026-98610

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amd smn init function where PCI device reference counting is handled incorrectly. The local root pointer, used as a temporary variable during device search, does n...

PT-2026-97891

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the svcrdma component where svc rdma accept fails to correctly handle the error path when rpcrdma rn register does not succeed. In this scenario, the cleanup block...

SUSE CVE-2026-90291

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-93181

CVE-2026-93181 affects the Linux kernel in the perf/x86/intel/uncore subsystem. The root cause is an incorrect call ordering: in the CPU online path, uncore_box_ref() was invoked before uncore_change_context(), so the gate on box->cpu >= 0 always failed and the uncore box was never initiali...

CVE-2026-90291: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no longer referenced. When releasing an instance, the kmodduprequestdelete...

CVE-2026-89841 f2fs: only redirty pinned folios in redirty_blocks

In the Linux kernel, the following vulnerability has been resolved: f2fs: only redirty pinned folios in redirtyblocks redirtyblocks pins folios with readcachefolio and then walks the same range again with filemaplockfolio to redirty them and drop the references it took. Commit 5951fee46bef "f2fs:...