CVE-2026-80821

CVE-2026-80821 affects the Linux kernel 's nvmet pci-epf driver (NVM Express over Fabrics Target, PCIe Endpoint Function). The vulnerability is a reference leak in nvmet_pci_epf_create_cq(): when PCI address-space mapping fails or returns a too-small partial mapping after nvmet_cq_create() succee...

EUVD-2026-71243

In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4xattrblockset retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without makin...

CVE-2026-53365

CVE-2026-53365 — VsockDrop: استنزاف عداد المراجع في النقل بصفر نسخ iouring + AFVSOCK، ورفع الامتيازات عبر إعادة كتابة Page-Cache مرآة توزيع من HackSpeak. هذا المستودع هو مرآة توزيع لـ MaherAzzouzi/vsockdrop ، والكود مطابق للمصدر الأصلي؛ ولا يتضمن المصدر الأصلي ترخيص LICENSE، لذا تعتمد المرآة وفق...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

cve-2026-23111-poc

CVE-2026-23111 لمزيد من التفاصيل، انظر notes.md الوصف وصف CVE من NIST يؤدي فحص منطقي مقلوب في nftmapcatchallactivate إلى عدم استعادة عدد المراجع nftchain-use عند إلغاء عملية DELSET. يتيح ذلك تحفيز UAF، ويمكن إساءة استخدامه للحصول على تصعيد الامتيازات المحلية تم إصلاح الخطأ في الالتزام...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 प्रूफ ऑफ कॉन्सेप्ट — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 एकल-फ़ाइल प्रूफ ऑफ कॉन्सेप्ट CVE-2026-43494 PinTheft के लिए: एक Linux कर्नेल स्थानीय विशेषाधिकार वृद्धि जो RDS zerocopy संदर्भ-गणना बग को iouring स्थिर बफ़र्स के...

CVE-2026-43494-PinTheft-PoC

SLEY — إثبات مفهوم PinTheft CVE-2026-43494 إثبات المفهوم — uid=1000raken → uid=0root بعد ./sley على WSL2 6.6.87.2-microsoft-standard-WSL2 إثبات مفهوم بملف واحد لـ CVE-2026-43494 PinTheft: تصعيد صلاحيات محلي في نواة لينكس يجمع بين خطأ في عدد مراجع RDS zerocopy والمخازن المؤقتة الثابتة في iouring...

Linux Distros Unpatched Vulnerability : CVE-2026-80642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while th...

SUSE CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

UBUNTU-CVE-2026-80692

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: hold conn in hciconnectacl/lesync callbacks There is theoretical UAF if the conn is freed while the hcisync task is running. Hold refcount to avoid that...

CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-80683

CVE-2026-80683 is a use-after-free vulnerability in the Linux kernel's Bluetooth SCO subsystem . The root cause is a reference-counting bug: the SCO socket stores a sco_conn pointer without holding its own reference. When a socket close() races the Bluetooth controller's Disconnection Complete ev...

CVE-2026-80642 liveupdate: Reference count incoming FLB data

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-80642

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

EUVD-2026-67518

In the Linux kernel, the following vulnerability has been resolved: liveupdate: Reference count incoming FLB data Increment the incoming FLB refcount in liveupdateflbgetincoming so that the FLB structure cannot be freed while the caller is actively using it. Add an additional...

CVE-2026-74735

A flaw was found in the Linux kernel's L2TP Layer 2 Tunneling Protocol implementation. A local user could trigger a reference count leak by closing specific /proc or /sys files related to L2TP tunnels and sessions before fully reading their content. This could lead to resource exhaustion,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098700)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098700 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the...

CVE-2026-74721

A flaw was found in the Linux kernel's accel/amxdna component. Specifically, an error in the amdxdnainsertpages function causes system resources to be released too early. This premature release can lead to a critical error when the system later attempts to free the same resources, resulting in a...

CVE-2026-74630

A flaw was found in the Linux kernel's IPv6 subsystem. The in6devget function can incorrectly increment the reference count of an inet6dev object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulti...

CVE-2026-74631

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...