CVE-2026-68121

⚡ CVE-2026-68121 - PPPoEject Linux Kernel PPPoE Use-After-Free → Local Privilege Escalation A Linux kernel memory-corruption vulnerability in the PPPoE transmit path , caused by a stale pointer to an skbuff header after a device header callback reallocates the skb head. ⚠️ Disclaimer This...

CVE-2026-98280

A flaw was found in the Linux kernel's Intel Xe graphics driver. During device unbinding, internal driver structures are freed before interrupt requests IRQs are disabled. If an interrupt occurs during this timing window, it can trigger a use-after-free condition where the system accesses already...

CVE-2026-98276

A flaw was found in the Linux kernel's networking subsystem. A local attacker can exploit a race condition during concurrent socket operations, such as retrieving timestamps while binding a network socket, because socket flags are modified without proper locking. This issue causes socket memory t...

huawei-p10-cve-2017-8890-unlock

Huawei P10 CVE-2017-8890 bootloader-unlock research This repository documents an owner-authorized research project that ported CVE-2017-8890 to one Huawei P10 firmware, converted the kernel use-after-free into arbitrary kernel read/write and temporary root, reconstructed Huawei's NVE journal,...

CVE-2026-43499-ZFOLD4

CVE-2026-43499-ZFOLD4 Device-specific research port of CVE-2026-43499 IonStack PI write-what-where for the Canadian Galaxy Z Fold4 SM-F936W on firmware F936WVLU1AVGA. This repository is the Fold4 counterpart of CVE-2026-43499-S24U and CVE-2026-43499-A36. It captures current incomplete progress:...

CVE-2022-22620

CVE-2022-22620 - "Zombie" Use-after-free in Safari Infoleak Exploit - leak an address of a JSObject Tested on webkitgtk-2.34.3 UBUNTU64 : https://webkitgtk.org/releases/webkitgtk-2.34.3.tar.xz Original PoC by Google Project Zero:...

CVE-2026-98266

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA subsystem. When an audio card is released asynchronously, such as during the disconnection of a USB sound device, active background tasks may continue accessing the device structure after it has been deallocated due to...

CVE-2026-98264

A flaw was found in the Advanced Linux Sound Architecture ALSA virtio sound driver in the Linux kernel. During device removal or system suspend operations, virtual queues are deleted before the virtual device is reset, allowing the device to access queue memory buffers after they have been freed...

CVE-2025-38352-PoC

CVE-2025-38352: Linux Kernel POSIX CPU Timer TOCTOU Race Condition & UAF A reproducible Proof-of-Concept PoC and automated GDB orchestration script for CVE-2025-38352 , a Time-of-Check to Time-of-Use TOCTOU race condition in the Linux kernel's POSIX CPU timer subsystem...

CVE-2026-98261

A flaw was found in the Linux kernel's Common Internet File System CIFS client. When a secondary communication channel is disabled or no longer supported by a remote file server, the client releases session structures from memory while continuing to access them. A malicious server can exploit thi...

CVE-2026-98260

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

CVE-2026-98258

A flaw was found in the Linux kernel's POSIX CPU timer subsystem. A race condition can occur when modifying or deleting a timer concurrently with its expiration handling, allowing the timer to be freed while still queued on an active expiry list. A local user could exploit this use-after-free UAF...

CVE-2026-98256

A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege...

io_uring-n-day

CVE-2024-0582 PoC This repository contains a proof of concept for CVE-2024-0582 page-level use after free in iouring used for academic research. It includes a kernel configuration, build and run scripts for a reproducible QEMU environment, and the PoC exploit used in my analysis. Use this code on...

PS-2018-002---CVE-2018-14442

Foxit Reader - CPDFParser::mpCryptoHandler - Use After Free - RCE Vulnerability Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code Vulnerability Description This vulnerability allows remote attackers to execute arbitrary code on...

POC_CVE-2026-45185

CVE-2026-45185 Nuclei Template Validation Lab This repository is not a general-purpose exploit PoC repository. It is a local validation lab for reproducing and reviewing the behavior of a CVE-2026-45185 template intended for contribution to projectdiscovery/nuclei-templates. The nuclei code...

cve-2017-11176

cve-2017-11176 Public Information The mqnotify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service use-after-free or possibly have...

CVE-2026-43499

CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free Bug removewaiter in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rtmutexstartproxylock when invoked from futexrequeue. In the proxy-lock case waiter::task is not current, but removewaiter incorrect...

CVE-2026-98381

A flaw was found in the Linux kernel's virtual Ethernet veth driver. When resizing network channels, the driver fails to properly clear references to detached eXpress Data Path XDP programs on removed receive queues. If the channel count is subsequently increased, the kernel may execute the freed...

CVE-2026-98378

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local attacker can trigger a use-after-free flaw by iterating over BPF links while a concurrent link creation operation fails. This issue occurs because the iterator references links before their initialization is...