345 matches found
EUVD-2026-38856
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: join hook list via splicelistrcu in commit phase Publish new hooks in the list into the basechain/flowtable using splicelistrcu to ensure netlink dump list traversal via rcu is safe while concurrent ruleset...
Astra Linux โ Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix for unbuffered write error handling If all the subrequests in an unbuffered write stream fail, the subrequest collector does not update the stream-transferred value, and it retains its initial LONGMAX value...
Astra Linux โ Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: In the net subsystem, do not write to the msggetinq field in the callee. This issue involves fixing the problem of NULL pointer dereferencing. msggetinq is an input field from the caller to the callee. Do not set it in the callee...
Astra Linux โ Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerabilities have been resolved: net/smc: fixed a warning in smcrxsplice, when calling getpage The smcloregisterdmb function allocates DMB buffers using kzalloc, which are later passed to getpage in smcrxsplice. Since kmalloc memory is not page-backed, this...
Astra Linux โ Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: nfsd: Do not replace a page in the rqpages array if it is a continuation of the last page. The splice read function calls nfsdspliceactor to place the pages containing file data into the svcrqst-rqpages array. However, it is...
Astra Linux โ Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: iouring/cmdnet: fixed incorrect argument types for skbqueuesplice. If retrying timestamp retrieval is necessary and the local list of SKBs already contains entries, then those entries are spliced back into the socket queue...
dirtyfrag
Dirty Frag Overview Dirty Frag is a class of Linux ke...
-authencesn-poc
authencesn-poc Mrowl made by c0redev https://unitdev.run...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
Copy Fail โ Python PoC CVE-2026-31431 This is a compact Pyt...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
copy-fail CVE-2026-31431 Copy Fail โ a C language PoC,...
Astra Linux - ััะทะฒะธะผะพััั ะฒ linux-5.10
There exists a use-after-free vulnerability in the Linux kernel through the iouring mechanism and the IORINGOPSPLICE operation. If the IORINGOPSPLICE operation lacks the IOWQWORKFILES flag, it indicates that the operation will not utilize current-nsproxy. As a result, the reference counter is not...
Astra Linux - ััะทะฒะธะผะพััั ะฒ linux-5.10
In the Linux kernel, the following vulnerability has been resolved: Net: TLS โ Fix for the WARNING message when using skmsgfree. A splice operation with MSGSPLICEPAGES causes the TLS sendmsg code to use the tlsswsendmsgsplice path to move the user-provided pages from the msg buffer to the msgpl...
Astra Linux - ััะทะฒะธะผะพััั ะฒ linux, linux-5.10, linux-5.15, linux-6.1
A memory write flaw that is outside the bounds of the systemโs security was discovered in the Linux kernelโs Transport Layer Security functionality. This flaw allows a local user to cause a crash or potentially escalate their privileges on the system...
Exploit for Write-what-where Condition in Linux Linux_Kernel
Dirty Frag - kernel Linux critical Vulnerability- CVE-2026-432...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
CVE-2026-31431 - Linux Kernel AFALG "Copy Fail" Local Privile...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
copyfail โ CVE-2026-31431 4-byte page-cache write primitive โ...
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years. TL;DR copy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC. It abuses the kernel crypto API AFALG sockets plus splice to write four bytes at a time straigh...
EUVD-2026-29037
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpcinputcallevent and the RESPONSE handler in rxrpcverifyresponse copy the skb to a linear one before calling into the security o...
CVE-2026-43500
Summary: CVE-2026-43500 affects the Linux kernel RXRPC path for DATA/RESPONSE packets. The issue occurs when skb fragments are externally owned (e.g., via splice() or frag lists) and the code path decrypts in place, binding frag pages into the AEAD/skcipher SGL. The fix extends the gate to unshar...
CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpcinputcallevent and the RESPONSE handler in rxrpcverifyresponse copy the skb to a linear one before calling into the security o...