CVE-2026-99185

A flaw was found in the Linux kernel's FireWire subsystem. A race condition occurs during split transaction handling when an incoming response and a timeout callback attempt to process the same transaction concurrently. An attacker could exploit this timing issue to cause a use-after-free...

CVE-2026-99166

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS subsystem. When handling connection events on non-InfiniBand Remote Direct Memory Access RDMA devices, the kernel fails to initialize an internal transport pointer. A remote attacker can exploit this vulnerability by sending a...

CVE-2026-99162

A flaw was found in the Linux kernel's General Purpose Input/Output GPIO subsystem. A use-after-free vulnerability occurs when adding shared proxies because a lookup table can outlive the device object whose name string is referenced. A local attacker could exploit this flaw to cause memory...

CVE-2026-99160

A flaw was found in the Linux kernel's ring buffer subsystem. A local user can exploit this vulnerability to cause a Denial of Service DoS by crashing the kernel. The issue occurs when reading ring buffer metadata files for a central processing unit CPU that has never come online, resulting in a...

CVE-2026-99159

A flaw was found in the Linux kernel's ring-buffer subsystem. A local user can cause a Denial of Service DoS by crashing the system when interacting with persistent ring buffers. Due to an incorrect sub-buffer index calculation, the kernel leaves an entry uninitialized, resulting in a null pointe...

CVE-2026-99153

A flaw was found in the Linux kernel's SCSI subsystem within the libiscsi module. A malicious or compromised iSCSI storage target can trigger a denial of service DoS or data integrity issues by sending a crafted Reject Protocol Data Unit PDU containing an unvalidated Initiator Task Tag ITT. Becau...

CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone When Shared Memory Stops Being Shared Safely. A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFLSHAREDFRAG flag inside the Linux networking stack. 📖 Overview CVE-2026-43503 , nicknamed DirtyClone , is a High Severity Local Privileg...

CVE-2017-0541

poc and vulnerability analysis of CVE-2017-0541...

CVE-2025-21756

CVE-2025-21756 — Exploitation Lab For educational and authorized security research purposes only. Description CVE-2025-21756 is a use-after-free UAF vulnerability in the Linux kernel's vsock Virtual Socket subsystem, disclosed on February 26, 2025. It allows a local attacker to escalate privilege...

CVE-2026-80776

A flaw was found in the Linux kernel's futex subsystem. A local attacker could exploit a race condition in the futexpivotpending function during a private hash resize operation. This vulnerability allows a malicious task to become indefinitely blocked, leading to a kernel panic and a Denial of...

CVE-2026-80761

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. The isosockgetname function fails to properly initialize the sockaddriso structure before returning it. This oversight allows an unprivileged attacker to read uninitialized kernel stack memory, leading to information disclosure...

uaf-exploit-cve-2026-23415

CVE-2026-23415 PoC Proof of concept for CVE-2026-23415 , a use-after-free vulnerability in the Linux kernel futex subsystem. About the vulnerability A race condition exists between futexkeytonodeopt and vmareplacepolicy. While the futex code reads a virtual memory area's NUMA memory policy, anoth...

CVE-2026-80763

A flaw was found in the Linux kernel's Bluetooth subsystem. A malicious or malfunctioning Bluetooth controller could send a specially crafted, truncated response to a command. This could lead to the kernel attempting to read beyond an allocated memory buffer, potentially causing a system crash...

d-os-descriptor

d-os-descriptor Summary The USB Gadget Subsystem includes security issues in the OS descriptor handling section of compositesetup function composite.c. Processing of properly crafted control transfer request messages result in device crash due to null pointer dereference or memory corruption...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

GTScan

GTScan The Nmap Scanner for Telco. With the current focus on telecom security, there used tools in day to day IT side penetration testing should be extended to telecom as well. From here came the motivation for an nmap-like scanner but for telco The current security interconnect security controls...

Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Remote git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284 && gcc -O0 -Wall -o exp exp.c -lutil && ./exp git clone https://github.com/6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284.git && cd...

CVE-2025-20352

CVE-2025-20352 SNMP Exposure Check onesixtyone + parser Fast, safe black-box exposure check for Cisco IOS/IOS XE devices related to CVE-2025-20352 SNMP subsystem: 1. Scan your subnets for SNMP using onesixtyone with default communities. 2. Parse sysDescr.0 banners with a small Python script to fl...

CVE-2026-98076

A flaw was found in the Linux kernel's tracing subsystem. When dynamic probe events are configured with multiple probes, removing the initial probe frees its argument name and type strings while the event remains registered. A local user with administrative or tracing privileges can trigger a...

CVE-2026-98099

A flaw was found in the Linux kernel. A local user could exploit a race condition in the IPv6 multicast subsystem to cause a Denial of Service DoS or kernel memory corruption. Because internal multicast lists are modified without proper synchronization helpers, concurrent socket operations can ra...