tag
Unprivileged
Windows CLFS.sys Unrecoverable State / BSoD via ReadFile on Log File Handle (CVE-2026-2636)
CVE-2026-2636 is a denial-of-service vulnerability in the Windows Common Log File System driver (CLFS.sys). An unprivileged local user can crash the system simply by calling the ReadFile Win32 API on a handle obtained via CreateLogFile — a call sequence CLFS…
Linux Kernel mm/mseal VMA-Merge Stale-Bound Bug (CVE-2026-23416)
CVE-2026-23416 is a logic bug in the kernel's mseal(2) implementation. msealapply() iterates over the target VMAs and advances its cursor by copying a previously-captured vmend value, but the underlying vmamodifyflags() call can merge adjacent VMAs…
Linux FUSE Readdir Cache Out-of-Bounds Write to Root LPE — CVE-2026-31694
fuseadddirenttocache() is missing a bounds check when copying a FUSE server-supplied directory entry into the kernel's readdir page-cache. A malicious (or attacker-controlled) FUSE server can return a dirent with namelen = 4095, which serializes to a…
DirtyDecrypt-Go — RxRPC rxgk Page-Cache Overwrite LPE (Go Port) — CVE-2026-31635
This is a Go re-implementation ("port") of the original C dirtydecrypt PoC, now tracked as its own CVE (CVE-2026-31635). The bug is a missing skbcowdata() call in rxgkdecryptskb(): the krb5enc AEAD used by RxRPC's rxgk security class decrypts skb payload data…
DirtyDecrypt / DirtyCBC — rxgk Page-Cache Write (Dirty Pipe Variant)
DirtyDecrypt (also called DirtyCBC) is a variant of the CopyFail / DirtyFrag / Fragnesia bug class. rxgkdecryptskb() in net/rxrpc/rxgkcommon.h calls skbtosgvec() followed by cryptokrb5decrypt() without first calling skbcowdata(). The krb5enc AEAD template…
Linux XFRM ESP-in-TCP Local Privilege Escalation (Fragnesia)
CVE-2026-46300 ("Fragnesia") is a universal Linux local privilege escalation vulnerability in the XFRM ESP-in-TCP subsystem. It is a member of the Dirty Frag vulnerability class — a separate bug from the original dirtyfrag — that abuses a logic flaw where the…