CVE-2026-43499-Redmi-Turbo5

CVE-2026-43499 Redmi Turbo 5 漏洞利用 此预加载库基于 duchamp-root 源代码构建。 ⚠️ 警告：仅供教育和授权安全研究使用。 本仓库提供了针对 CVE-2026-43499 （GhostLock）的概念验证漏洞利用，目标设备为 小米 Redmi Turbo 5 。该漏洞利用 Linux 内核 futex PI（优先级继承）requeue 路径中的释放后使用（use-after-free）漏洞，实现本地权限提升，并在不解锁引导加载程序或修改引导镜像的情况下安装 KernelSU。 ⚠️ 免责声明 本软件仅供教育和安全研究目的使用。 请勿...

ghostlock-cve-2026-43499-4.19-k40

GhostLock — CVE-2026-43499 PoC（Qualcomm 4.19 内核） 本地权限提升，利用 CVE-2026-43499 —— 一个 rtmutex removewaiter 缺陷，该缺陷会在等待者的内核栈上留下一个悬空的 struct rtmutexwaiter（kernel/locking/rtmutex.c，CWE-416 释放后使用）。 改编自 NebuSec/CyberMeowfia （IonStack/CVE-2026-43499，Apache-2.0），面向 Qualcomm Android 4.19.x 厂商内核系列。...

Rocky Linux 10.2 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_38492)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202638492 advisory. kernel: md/bitmap: fix GPF in writepage caused by resize race CVE-2026-43163 kernel: rtmutex: Use waiter::task instead of current in removewaiter...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nbd: fixed the race condition between timeout and normal completion. If the request for a timeout is handled by nbdrequeuecmd, normal completion must be stopped to avoid completing this queued request. This could potentially...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: futex: Prevention of use-after-free during requeue-PI The syzbot was able to trigger the following race condition: T1 → T2 The sequence of operations is as follows: c futexwaitrequeuepi futexdowait schedule futexrequeue...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: sched/core: Do not requeue tasks on CPUs excluded from cpusmask. The following warning was triggered on a large machine during boot time in a distribution kernel; the same issue should also affect the mainline version of the...

Linux Distros Unpatched Vulnerability : CVE-2026-89461

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instan...

CVE-2026-89465

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: quiesce delayed work before teardown The threaded IRQ handler can queue pwrrdywork, maxchargingtimework and battpresencework. pwrrdywork and battpresencework can also queue maxchargingtimework, while...

UBUNTU-CVE-2026-89461

In the Linux kernel, the following vulnerability has been resolved: power: supply: max17040: synchronize work cancellation on suspend max17040work requeues itself after every poll. canceldelayedwork only cancels a pending instance and does not wait for a callback that is already running. If syste...

CVE-2026-89647

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

EUVD-2026-76559

In the Linux kernel, the following vulnerability has been resolved: ceph: do not repeat cephtrimdentries if no progress possible cephcapreclaimwork re-queues itself for as long as cephtrimdentries returns -EAGAIN, which happens whenever a lease walk exhausts its nrtoscan budget. This creates a bu...

CVE-2026-89647

CVE-2026-89647 affects the Linux kernel's Ceph file system . The function ceph_cap_reclaim_work() enters a busy loop by re-queuing itself whenever ceph_trim_dentries() returns -EAGAIN, which occurs when a lease walk exhausts its scan budget with no cap pressure and all leases still valid. The dir...

PT-2026-90177

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists during system suspend in the fuel gauge driver. The function max17040 work requeues itself after every poll, but the use of cancel delayed work only cancels pendi...

SUSE CVE-2026-72434

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...