CVE-2021-4204

CVE-2021-4204 Chinese writeup: https://tr3e.ee/posts/cve-2021-4204-linux-kernel-ebpf-lpe.txt For educational/research purposes only. Use at your own risk. Build & Run $ sh buildandrun.sh Build from source... cc -I include -static -w -o exploit exploit.c Start exploit! This might take some while...

CVE-2025-21333-POC

CVE-2025-21333-POC Proof of Concept that exploits CVE-2025-21333 in vkrnlintvsp.sys not so reliable see Requirements and Limitations section. Under the References section are located very helpful resources for who wants to play with the exploit. A detailed analysis of the vulnerability and the...

CVE-2026-98937

CVE-2026-98937 — perf kernel callchain permission bypass English | 简体中文 Linux perf/core permission-check bypass: an unprivileged task can request kernel callchains while setting excludekernel=1, skipping the perfallowkernel gate and disclosing kernel stack frames through the perf ring buffer. Thi...

CVE-2020-11179-Adreno-Qualcomm-GPU

My independent work from the poc created by P0 researcher Ben Hawkes Original article: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html My goal is to convert his poc to C, and continue where he left off and turn the poc into either a root shell, or a kernel r/w, a...

EUVD-2025-211290

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity...

CVE-2025-62620

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity...

CVE-2025-62620

The AMD Secure Encrypted Virtualization (SEV) firmware is affected by CVE-2025-62620 , where improper validation of unsafe equivalence in input allows a high-privilege attacker to reclaim the ring buffer queue status page . This vulnerability can potentially lead to a loss of guest memory integri...

CVE-2025-62620

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity...

PT-2026-144776

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity...

CVE-2025-62620: AMD: Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring…

Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Since ringbuffersubbuforderset frees buffer pages, we cannot allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free rbadvanceiter...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fixed an uint32 overflow in the EOP ring buffer size alignment. eopringbuffersize in struct queueproperties is a u32. In kfdqueueacquirebuffers, the expected EOP buffer size is calculated as ALIGNeopringbuffersize,...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racey with ringbuffersubbuforderset; it can allocate a reader page with an outdated order. This isn’t a major issue, as users can still...

Astra Linux – vulnerability in linux-6.12

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix possible dereference of uninitialized pointer There is a pointer headpage in rbmetavalidateevents which is not initialized at the beginning of a function. This pointer can be dereferenced if there is a failure...

CVE-2026-99160

A flaw was found in the Linux kernel's ring buffer subsystem. A local user can exploit this vulnerability to cause a Denial of Service DoS by crashing the kernel. The issue occurs when reading ring buffer metadata files for a central processing unit CPU that has never come online, resulting in a...

CVE-2026-99159

A flaw was found in the Linux kernel's ring-buffer subsystem. A local user can cause a Denial of Service DoS by crashing the system when interacting with persistent ring buffers. Due to an incorrect sub-buffer index calculation, the kernel leaves an entry uninitialized, resulting in a null pointe...

CVE-2026-99158

A flaw was found in the Linux kernel's ring buffer component. When a reader process accessing memory-mapped trace data catches up with a concurrent writer still committing events, the kernel incorrectly treats the temporary absence of data as an error and triggers a kernel warning. A local user...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO CVE-2026-72315 In the Linux...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-3335)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3335 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts CVE-2026-68399 In the Linux kernel, the following vulnerability has been resolved:...

CVE-2026-99160

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer-bufferscpu is only allocated once that CPU comes online. Reading the file of a CPU that...