tag
Kernel
Ubuntu Linux Kernel PPPoL2TP Use-After-Free Local Privilege Escalation (CVE-2026-68398)
CVE-2026-68398 is a use-after-free race condition between PPPoL2TP receive processing and destruction of a bound-but-unattached PPP channel in the Linux kernel. The PPPoX socket and its embedded pppchannel are RCU-safe, but the internal struct channel used by…
Linux nf_tables Catchall Set Element UAF -- Local Privilege Escalation (CVE-2026-23111)
CVE-2026-23111 is a use-after-free in the Linux nftables subsystem caused by an inverted genmask check in nftmapcatchallactivate(). During transaction abort, the handler skips inactive catchall elements that need reactivation and processes active ones that do…
Linux AF_UNIX GC vs MSG_PEEK Use-After-Free Container Escape (CVE-2026-53361)
CVE-2026-53361 is a use-after-free in the Linux AFUNIX socket garbage collector triggered via a MSGPEEK race. The GC reclaims in-flight sockets forming unreachable reference cycles, but a concurrent MSGPEEK can take a reference the GC census never counts. The…
Linux Kernel — SCTPhantom: SCTP ASCONF DEL-IP Use-After-Free Local Privilege Escalation (CVE-2026-64564)
CVE-2026-64564 is a use-after-free vulnerability in the Linux kernel SCTP ASCONF DEL-IP processing. When a multihomed SCTP association processes an ASCONF chunk that deletes an IP address, the associated transport structure is freed but a dangling pointer…
Linux Kernel — qdisc Rate-Table Race Condition Local Privilege Escalation (CVE-2026-68138)
CVE-2026-68138 is a race condition in the Linux kernel traffic-control rate-table code that leads to a use-after-free or double-free of struct qdiscratetable. The flower classifier sets TCFPROTOOPSDOITUNLOCKED, allowing RTMNEWTFILTER requests to reach…
Linux Kernel — OVSwrap: Open vSwitch Conntrack Local Privilege Escalation (CVE-2026-64531)
CVE-2026-64531 is a memory corruption vulnerability in the Linux kernel Open vSwitch (OVS) conntrack subsystem. The exploit, named OVSwrap, uses OVS Generic Netlink operations to corrupt conntrack timeout and labels carrier objects, establishing kernel read…
XNU PF_ROUTE RTA_GENMASK Heap Buffer Overflow (CVE-2026-20698)
XNU's routing socket implementation processes RTMGET messages carrying an RTAGENMASK sockaddr through rnaddmask(), which copies the supplied genmask into a fixed, address-family-dependent radix-tree node buffer without validating that the attacker-controlled…
Windows Push Notification Service Use-After-Free Race (CVE-2026-42978)
CVE-2026-42978 is a use-after-free race condition (CWE-362) in wpncore.dll's PresentationEndpointFacade class, which backs the WpnService Windows Push Notification service running as NT AUTHORITY\SYSTEM. Facade methods (e.g. ToastUnblockAll) fetch a pointer…
Windows Kernel Local Privilege Escalation via SeDebugPrivilege Bit Corruption (CVE-2026-40369)
This exploit is a local privilege escalation chain against the Windows kernel that abuses a low-level primitive reachable through NtQuerySystemInformation to corrupt a bit near the process's SeDebugPrivilege state in kernel memory, without requiring the…
Windows HTTP.sys Header-Count-Triggered Kernel Memory Corruption / BSOD (CVE-2026-49160)
This PoC targets a memory-safety bug in the Windows HTTP.sys kernel driver's request header parsing path (HTTP!UlpParseNextRequest / HTTP!UlpHandleRequest). The included http2bomb.py script establishes a TLS/HTTP2 connection to a target IIS/HTTP.sys-backed…
Portwell Engineering Toolkits Driver Arbitrary Physical Memory R/W LPE (CVE-2026-3437)
portwell.sys, a legitimately signed driver shipped with Portwell Engineering Toolkits v4.8.2, exposes IOCTL handlers that let any local user-mode process read and write arbitrary physical memory via MmMapIoSpace, with no validation of the caller-supplied…
KVM SEV-SNP Page State Change (PSC) Heap Out-of-Bounds — CVE-2026-53360
KVM's SEV-SNP Page State Change (PSC) handler trusts a guest-supplied entry count against a fixed protocol constant (VMGEXITPSCMAXCOUNT = 253) instead of validating it against the actual size of the buffer the host allocated for the request. When a guest…
FreeBSD setcred(2) Kernel Stack Buffer Overflow — Local Privilege Escalation (CVE-2026-45250)
kernsetcredcopyinsuppgroups() in sys/kern/kernprot.c uses sizeof(groups) where groups is declared as gidt , so the size expression evaluates to 8 bytes (pointer size) instead of the intended 4 bytes (sizeof(gidt)). When the supplementary-groups count is small…
FreeBSD OSS /dev/dsp Stale Kernel-Stack Buffer Local Privilege Escalation (CVE-2026-49417)
exp.c is a local FreeBSD kernel privilege-escalation exploit built around /dev/dsp (the OSS sound driver). It sprays hundreds of pthreads that call nanosleep() with distinctively tagged tvnsec values so their kernel stacks/return addresses are recognizable,…
FreeBSD exec_args_adjust_args() Out-of-Bounds memmove — Local Privilege Escalation via sshd Race (CVE-2026-7270)
An operator-precedence bug in FreeBSD's execargsadjustargs() (present since 2013) computes a memmove size using + consume instead of - consume, causing the copy length to be roughly double the correct value. With a ~265KB argv[0] supplied via a shebang exec,…
FreeBSD /dev/dsp (OSS) Negative-Offset mmap Kernel Memory Corruption LPE (CVE-2026-45258)
This PoC targets a FreeBSD kernel local privilege escalation reachable through the OSS /dev/dsp audio device driver. By configuring device fragment sizes via ioctl(SNDCTLDSPSETFRAGMENT, ...) and then mmap-ing the device with a crafted negative file offset,…
AppleSEPKeyStore IOKit Use-After-Free (CVE-2026-20637)
The AppleSEPKeyStore kernel driver exposes an IOKit user client (AppleKeyStore) whose command gate can be freed while still being accessed, producing a use-after-free. The PoC opens repeated IOServiceOpen connections while separate threads race…
AppleM2ScalerCSCDriver Shared Scheduler Use-After-Free (CVE-2026-43655)
CVE-2026-43655 is a use-after-free in the AppleM2ScalerCSCDriver kernel driver's shared scaler-operation scheduler, reachable from a default-sandboxed iOS/iPadOS/macOS app with no special entitlements (only get-task-allow, no jailbreak or private…
AppleJPEGDriver startDecoder Timeout Use-After-Free (CVE-2026-20687)
AppleJPEGDriver's synchronous decode path (startDecodersync) can time out while a decode request is still referenced by a per-codec queue-node vector; on timeout the driver frees the request object but fails to remove its embedded queue-node pointer from that…
HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166)
CVE-2021-31166 is a remote use-after-free vulnerability in the Windows HTTP Protocol Stack (http.sys) that is reachable via crafted HTTP headers. The public PoC sends a malformed Accept-Encoding header to trigger unsafe list handling in the kernel HTTP parser…
Linux XFRM ESP-in-TCP Local Privilege Escalation (Fragnesia)
CVE-2026-46300 ("Fragnesia") is a universal Linux local privilege escalation vulnerability in the XFRM ESP-in-TCP subsystem. It is a member of the Dirty Frag vulnerability class — a separate bug from the original dirtyfrag — that abuses a logic flaw where the…