Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons This project is mostly a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent. All checks are based on the observation that C2 agents wait between their callbacks causing the beacons thread to idle and this tool aims to analyze what...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: gpio: ml-ioh: use rawspinlockt for the register lock iohirqtype is registered as the irqchip .irqsettype callback and takes chip-spinlock with spinlockirqsave. This callback is reached from setupirq - irqsettrigger -...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state via schirqmaskunmask, which utilizes sch-lock with spinlockirqsave. This callback can be invoked from...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegragpiodirectioninput and tegragpiodirectionoutput already program the GPIO controller direction registers directly. The additional pinctrlgpiodirectioninput/output calls do n...

SleepyCrypt

SleepyCrypt A shellcode function to encrypt a running process image in memory when sleeping. This is the companion code for my blog post here. Build Just run build.sh to compile the C code, extract the .text section as shellcode, and compile it into a test binary called sleep.exe. This will requi...

CVE-2026-98986

A flaw was found in the Linux kernel's mount namespace subsystem. When cleaning up a mount namespace associated with filesystem notification marks, the kernel improperly attempts to acquire a sleeping lock within an invalid interrupt context. A local user with privileges to manage mount namespace...

UBUNTU-CVE-2026-98986

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mntnsrelease drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotifymntnsdelete. That takes the mutex of every...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131776 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Drop fpregs lock before inheriting FPU permissions Mike Galbraith reported the following...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Move the cdns set active part outside the spin lock The device may be scheduled during the resume process, so this cannot appear in atomic operations. Since pmruntimesetactive will resume suppliers, put set active...

Astra Linux – vulnerability in linux, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: Fix sleeping function called from invalid context The driver can call the card-isac.release function from an atomic context. Fix this by calling this function after releasing the lock. The following log reveals it:...

CVE-2026-90338

A flaw was found in the Linux kernel's amba-pl011 serial driver. When the pl011consolewriteatomic function is called from an atomic context, such as during a printk operation on a PREEMPTRT kernel, it attempts to acquire a sleeping lock. This action is forbidden in an atomic context and can lead ...

SUSE CVE-2026-98223

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

Linux Distros Unpatched Vulnerability : CVE-2026-98223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios...

DEBIAN-CVE-2026-98223

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98223

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

UBUNTU-CVE-2026-98223

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98223

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98223 mm: filemap: retain mapped dropbehind folios

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98223

The Linux kernel contains a vulnerability where Fault-around can map ready dropbehind folios without undergoing the standard page-cache lookup. Because a mapping represents a competing cached user, the system should retain the folio rather than forcibly unmapping it upon writeback completion. If ...

CVE-2026-98223 mm: filemap: retain mapped dropbehind folios

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...