StackRot

StackRot CVE-2023-3269: Linuxカーネルの権限昇格の脆弱性 GitHub-CIで検証されたエクスプロイト Linuxカーネル6.1から6.4におけるスタック拡張の処理に欠陥が見つかり、「Stack Rot」と呼ばれています。仮想メモリ領域の管理を担当するメイプルツリーは、MM書き込みロックを適切に取得せずにノードの置き換えが行われる可能性があり、use-after-freeの問題を引き起こします。特権のないローカルユーザーがこの欠陥を利用してカーネルを侵害し、権限を昇格させる可能性があります。...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF エクスプロイト - Windows 10 19H1 x64 向け このエクスプロイトは、ws2ifsl.sys の最近パッチされた Use-After-Free 脆弱性 CVE-2019-1215 を利用して、ローカル権限昇格 Local Privilege Escalation を達成します。このエクスプロイトは Windows 10 19H1 1901 x64 を対象としており、kASLR、kCFG、SMEP を回避する方法を示しています。Medium Integrity...

CVE-2025-30400

CVE-2025-30400 概念実証: Windows DWM Use-After-Free UAF プロジェクト概要 このリポジトリは CVE-2025-30400 概念実証 を提供する Python プログラムであり、Microsoft Windows Desktop Window Manager DWM Core Library CVE-2025-30400 で報告されたような Use-After-Free UAF 権限昇格ゼロデイ脆弱性 の影響を示すためのものです。この重大な脆弱性は 2025 年 5 月に実際に悪用され、攻撃者が SYSTEM 権限昇格を達成できるものでした。...

EUVD-2026-71502

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/tas2781: Cancel async firmware request at unbind TAS2781 HDA I2C and SPI queue RCA firmware loading from component bind with requestfirmwarenowait. The firmware loader keeps the callback module pinned and holds a device...

EUVD-2026-71301

In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context updates PDP contexts can be deleted through GTPCMDDELPDP or while the GTP network device is being unregistered. The latter is serialized by RTNL, but the generic-netlink delete path only holds RCU...

EUVD-2026-71307

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FRFINISHED on abortonkill to prevent use-after-free The abortonkill path in requestwaitanswer calls fuseabortconn and returns without waiting for FRFINISHED. If fusedevdowrite is concurrently processing the same...

EUVD-2026-71299

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of currentkey on reconnect to another peer tcpinboundaohash is called before bhlocksocknested is taken, with only rcureadlock held. On the fast path for established sockets, if the rnextkeyid sent b...

EUVD-2026-71314

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp rxeqpfromattr handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and runs while the responder task rxereceiver recvtask on rxewq is live. A...

EUVD-2026-71300

In the Linux kernel, the following vulnerability has been resolved: tcp: fix AO info use-after-free in tcpaoconnectinit tcpv4connect adds a SYN-SENT socket to the ehash before calling tcpconnect. If TCP-AO is configured, tcpconnect first verifies that a key matches the peer and the bound device's...

EUVD-2026-71304

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ftcm: keep port count until LUN teardown completes tcmusbgdropnexus permits session removal once tpgportcount reaches zero. However, usbgportunlink currently decrements that count from the fabricpreunlink callback,...

EUVD-2026-71292

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context brmulticasttoggleonevlan clears BRVLFLAGMCASTENABLED under br-multicastlock before stopping a VLAN's multicast context. That is the teardown handshake:...

EUVD-2026-71284

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...

EUVD-2026-71283

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Remove cryptorng interface Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...

EUVD-2026-71298

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcpclose frees emsg-skb via kfreeskb without holding any socket lock. Concurrently, the xfrmtransreinject wor...

EUVD-2026-71280

In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usbwakeupnotification Add a spin lock to usbwakeup notification to prevent a race condition with dereferencing freed memory. This could be hit by the xHCI driver as it calls this function from an IRQ and...

EUVD-2026-71291

In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TXRING free until skbs finish AFPACKET TXRING skbs keep a raw pointer to their ring frame. The skb page references preserve page-backed ring blocks after pgvec is freed, but they do not preserve a vmallo...

EUVD-2026-71287

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: don't queue packet path object notifications All file:line references below are against v7.2-rc4 ac5b0e5651b1. The trace was captured on 7.2.0-rc6-kasan72rc6 075b74841bd0, where the same lines apply...

EUVD-2026-71276

In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free in c67x00addisourb When TD creation fails for the last packet of an isochronous URB, c67x00addisourb gives the URB back before updating the endpoint scheduling state. c67x00givebackurb frees the UR...

EUVD-2026-71253

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMDSYNC use-after-free on teardown armsmmuimplremove is registered as a devres action in armsmmuimplprobe, before armsmmuinitqueues allocates smmu-cmdq.q.base. On a devres unwind, whether a failed probe ...

EUVD-2026-71274

In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease usbdevrelease drops its reference to the struct usbdevice before draining the list of completed async URBs, but that drain path reads back through the same object:...