CVE-2026-43494

🛠️ PinTheft — CVE-2026-43494 Local Privilege Escalation in Linux Kernel via RDS + iouring Page Cache Overwrite 📌 Overview PinTheft is a sophisticated local root exploit for CVE-2026-43494 , a reference-counting bug in the Linux kernel's Reliable Datagram Sockets RDS subsystem. By combining a...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

CVE-2023-20938

CVE-2023-20938 Vulnerability Analysis 1. Client A and Client B establish a Binder connection via the ServiceManager context manager. 2. A creates node 0xbeef node = bindernewnodeproc, fp;. B references node 0xbeef via ref-targetnode. 3. B correctly processes targetnode 0xbeef, enqueuing the...

CVE-2026-98983 unshare: don't drop active namespace references that were never taken

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switchtasknamespaces and copynamespaces and dropped...

CVE-2026-98459

A flaw was found in the Linux kernel's Bluetooth subsystem. This flaw allows a local user to cause a Denial of Service DoS due to improper reference counting when handling Broadcast Isochronous Stream BIS connections. During unlinking operations, the kernel may prematurely release an active paren...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siwqpdestroy call; thu...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-pci: Fixed a possible memory leak caused by missing pcidevput pcigetdevice increments the reference count for the returned pcidev. We must use pcidevput to decrement the reference count before amdprobe returns. There i...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: drbd: add missing krefget in handlewriteconflicts When two-primaries is enabled, DRBD attempts to detect “concurrent” writes and handle write conflicts so that even if both nodes write to the same sector simultaneously, they end ...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: Fix error handling in probe function Add mtkmdpunregisterm2mdevice on the error handling path to prevent resource leaks. Add a check for the return value of vpugetplatdevice to prevent null pointer dereferencing...

Astra Linux - vulnerability in linux

In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing cadpid During boot, kernelinitfreeable initializes cadpid to the init task's struct pid. Later on, we may change cadpid via a sysctl, and when this happens procdocadpid will increment the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net/smc: fixed a kernel panic caused by a race condition involving smcsock. A crash occurs when smccdctxhandler attempts to access smcsock, but smcrelease has already freed it. 4570.695099 BUG: Unable to handle a page fault for...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The powersupply framework is not actually designed to have long-lived kernel references to powersupply devices. Specifically, unregistering a powersupply...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: cachefiles: All requests are flushed after setting CACHEFILESDEAD. In ondemand mode, when the daemon is processing an open request, if the kernel marks the cache as CACHEFILESDEAD, the cachefilesdaemonwrite function will always...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fixed Use-after-Free, failed to increment the ref count of the skb while it was in use. This patch addresses a Use-after-Free issue identified by the syzbot. The problem arises when a skb is taken from the per-session...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1, Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: TLS: Fixed a race condition between the async notify and socket close operations. The thread that submitted the request the one that called recvmsg/sendmsg may exit as soon as the async crypto handler’s call completes. Any cod...

Astra Linux - vulnerability in poppler, poppler-22

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Since std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 fixes this issue...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is a race condition between smb2 session log off and smb2 session setup. This causes user-after-free from session log off. This add sessionlock when setting SMB2SESSIONEXPIRED...

Astra Linux – vulnerability in linux, linux-5.10, linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939sockslock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939sockslock - activesessionlistlock -...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: spi: tegra20-slink: Fixed a UAF Use-after-Allocation issue in tegraslinkremove. After calling spiunregistermaster, the refcount of the master will be decreased to 0, and it will be freed in spicontrollerrelease. The device data...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: smb: Client side – fixed a potential deadlock that could occur when releasing mids. All callers of releasemid seem to hold a reference to @mid; therefore, there is no need to call krefput&mid-refcount, releasemid under...