CVE-2026-94024

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended...

EUVD-2026-105147

The Module Manager's object lookup validated one byte of a memory-protected module's search name and then walked as much of it as the module declared, in privileged mode, with the kernel's preemption count raised. Both lookup dispatchers are affected: the recommended...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives straight from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and reads the bytes directly from disk. Targets: C:\Windows\System32\config\SAM...

page_table_walk

Capture the Flag in Physical Memory You've read about paging. The diagrams make sense. Four levels, 9 bits each, page frame, offset. Sure. But then you hit a challenge that requires actually walking page tables, and you realize you don't know it. You know about it. Big difference. What worked for...

CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

EUVD-2026-103655

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610

The Linux kernel contains a vulnerability in the net/sched: sch_hfsc component where the classify inner-filter walk is unbounded. When hfsc_adjust_levels() raises a class level without revalidating existing bindings, it can create a cycle between two interior classes. During classification, the s...

CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

gortex-PoC

Symlink Following in Indexer File-Walk → Out-of-Repo Content Disclosure via searchtext CVE status: requested, pending assignment. This finding is published as GHSA-6vhf-4wcm-2r83. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-gortex-PoC and this banner is replaced with the CVE link....

CVE-2026-93683

A Time-of-check Time-of-use (TOCTOU) vulnerability exists in the DPDK vhost library when handling a virtio indirect descriptor table. The host reads the table length from guest memory multiple times, potentially allowing a guest to change the length between reads or provide an out-of-range next i...

CVE-2026-93683 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

CVE-2026-93683 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an...

PT-2026-114366

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390 crypto component where return codes from the skcipher walk virt function were not properly validated before entering processing loops in ecb aes crypt and ctr...

rsync: Fix of 6 CVEs

CVE-2026-53784: confine the daemon's absolute chdir target with a new ownership-walk resolver so a planted parent symlink cannot steer a "use chroot = no" module root outside the module - CVE-2026-53786: strip a real moduledir prefix before the daemon-filter check on a merge-file path -- leaving...

PT-2026-110430

Name of the Vulnerable Software and Affected Versions ngx cache purge versions prior to 3.0.4 Description An issue exists where file deletion is possible via a symlink attack when nginx and a served application, such as WordPress, operate under the same user account. This occurs because the ngx...

CVE-2026-98186

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiexsearchouiinie reads a pairwise-cipher PTK count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing...

PT-2026-106618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the af unix module where the unix vertex dead function incorrectly assumes all vertices in a Strongly Connected Component SCC share the same lowpoint, represented by t...