pintheft

PinTheft — RDS zerocopy double-free LPE tracking site Source for the PinTheft patch-status tracker: a single-page site recording which distributions have shipped a fix for the RDS zerocopy double-free privilege escalation in the Linux kernel. Where the facts live Everything about the bug — CVE ID...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

tcp-zerocopy-sm

Investigation is closed. Working fork: https://github.com/soumarcelino/Root-My-Galaxy-SM-S918B Read this - https://github.com/BuSung-dev/Root-My-Galaxy-Payloads/issues/160issuecomment-5227077583 Attempts to cause rights elevation w GhostLock via TCP Zerocopy. Designed expecially for 5.15. samsung...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

CVE-2026-43494-PinTheft-PoC

SLEY — PinTheft PoC CVE-2026-43494 Proof of concept — uid=1000raken → uid=0root after ./sley on WSL2 6.6.87.2-microsoft-standard-WSL2 Single-file proof-of-concept for CVE-2026-43494 PinTheft: a Linux kernel local privilege escalation that chains an RDS zerocopy reference-count bug with iouring...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the net: gro subsystem, do not merge the zcopy state when copying fragments between the source skb and the GRO skb. The skbgroreceive function currently copies fragments between the source skb and the GRO skb, without checking...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/rds: opnents is reset when zerocopy page pin fails. When iovitergetpages2 fails in rdsmessagezcopyfromuser, the pinned pages are released using putpage, and rm-data.opmmpznotifier is cleared. However, we fail to properly clea...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: In the net: stream module, the purge skerrorqueue operation in skstreamkillqueues has been fixed. Changheon Lee reported TCP socket leaks, with a detailed reproduction guide. It appears that we encounter TCP socket leaks in the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

Linux Distros Unpatched Vulnerability : CVE-2026-80977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged...

CVE-2026-80977

A flaw was found in the Linux kernel's networking subsystem. The skbtxerror function improperly handles shared zerocopy state in socket buffers skbs. When a cloned skb is processed, it can prematurely signal that its pages are free and drop shared fragment flags while the original skb is still in...

DEBIAN-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100568 CVE-2026-89487 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

AZL-100274 CVE-2026-80977 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

DEBIAN-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

UBUNTU-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-89487 openvswitch: only skb_tx_error() a packet we are about to drop

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...