CVE-2021-43267

CVE-2021-43267 Local PoC exploit for CVE-2021-43267 Linux TIPC Reference: https://haxx.in/posts/pwning-tipc/...

CVE-2024-36886

N-Day Vulnerability Research Overview This project focuses on N-Day vulnerabilities in the Linux kernel, with an emphasis on understanding their lifecycle, analyzing their impact, and exploring mitigation strategies. N-Day vulnerabilities are publicly disclosed flaws that remain unpatched on many...

CaptainAI-LPE-CVE-2026-52993

CVE-2026-52993 — reproduction Double-free / slab-use-after-free in the Linux kernel TIPC fragment reassembly path, tipcbufappend in net/tipc/msg.c. Reproduction this repo | ---|--- Component| net/tipc/msg.c — tipcbufappend / tipcmsgvalidate Class| CWE-415 double free manifests as...

CVE-2026-64563_EXP

CVE-2026-64563EXP For experimental research only. The code for prefetch and nperm the memory reference set.gdb needs to be configured is not attached, and since it has not been optimized, the hit probability is low. The author noticed that the vulnerability author has already released relevant...

kernel: tipc: require net admin for TIPCv2 netlink mutators

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC version 2 component. This vulnerability allows a local unprivileged attacker to bypass administrative permission checks when performing network link operations. Consequently, the attacker can modify critical TIPC...

CVE-2022-0435-Poc

CVE-2022-0435stack overflow wget https://releases.ubuntu.com/jammy/ubuntu-22.04.5-live-server-amd64.iso mkdir kernel wget https://kernel.ubuntu.com/mainline/v5.13/amd64/linux-headers-5.13.0-051300-generic5.13.0-051300.202106272333amd64.deb wget...

PT-2026-144483

In tipc dev probe of tipc virtio dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc using the plain kfree provided by tipcdiscdelete, but tipcdiscrcv still dereferences b-disc during the RX softirq under rcureadlock tipcudprecv ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: clears sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert the new socket tipcskinsert returns non-zero, its error path frees the sk using skfree, but leaves sock-sk pointing to the freed...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server’s send and receive workqueues were still running. Socket callbacks and subscription events could th...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanupbearer due to premature dstcachedestroy TIPC UDP media bearer teardown calls dstcachedestroy on its replicast caches before calling synchronizenet to wait for concurrent RCU readers transmitters to finish:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit The cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. Since the loop never terminates, genlmutex is never released, and other...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tipc: requires net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

MiracleLinux 8 : kernel-4.18.0-553.181.1.el8_10 (AXSA:2026-2276:118)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2276:118 advisory. kernel: ipv6: exthdrs: refresh nh pointer after ipv6hopjumbo CVE-2026-63924 kernel: ipv6: exthdrs: refresh nh after handling HAO option...

MiracleLinux 9 : kernel-5.14.0-687.64.1.el9_8 (AXSA:2026-2261:117)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2261:117 advisory. kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-52929 kernel: ipv6: sit: reload inner IPv6 header after GSO offloads...

SUSE CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...

CVE-2026-99246

A flaw was found in the Linux kernel's TIPC Transparent Inter-Process Communication subsystem. A race condition occurs when tracing link reset events without proper locking, which can cause link data to be freed while it is actively being accessed. An unauthenticated remote attacker could exploit...

CVE-2026-99246

In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipcnoderesetlinks trace event asks tipcnodedump to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock...