Ubuntu fixes Linux kernel io_uring flaws enabling local denial of service
CVE-2026-80811 can exhaust memory and CVE-2026-81009 can hang the system; a third issue is only partly described.
Stories per day · 30 days
3 RSS
Relatedprivilege-escalation12xorg8zdi6heap-overflow5linux-kernel4use-after-free4x-org-server3information-disclosure2cifs1cisco1cve-2026-1111851cve-2026-935241cve-2026-935361denial-of-service1glamor1integer-overflow1integer-underflow1io-uring1
23 stories, newest first · one card per story
Stories tagged #local
X.Org Server ProcDRI2GetBuffers overflow allows local privilege escalation
ZDI rates CVE-2026-50264 at 7.8; exploitation needs prior low-privileged code execution.
Linux kernel IPv6 AH routing header bug enables local privilege escalation
ZDI rates CVE-2026-80844 at CVSS 8.8; an attacker needs low-privileged code execution first.
Cisco Secure Client posture module allows local privilege escalation
An authenticated local user can send crafted IPC messages and gain limited SYSTEM or root file writes.
37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released
Researchers released a patched OpenBSD local root exploit chaining a 37-year-old shared-memory bug.
ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure Vulnerability
ZDI discloses a local use-after-free in X.Org Server that can leak information after low-privileged code execution.
ZDI-26-774: NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
ZDI disclosed a CVSS 7.8 uncontrolled search path flaw in NoMachine enabling local privilege escalation.
ZDI-26-768: X.Org Server XInput ProcXIPassiveUngrabDevice Heap-based Buffer Overflow Privilege Escalation Vulnerability
ZDI disclosed a local heap overflow in X.Org Server XInput that can escalate privileges.
USN-8875-1: Linux kernel vulnerabilities
Ubuntu patches Linux kernel flaws, including a local null-pointer crash in the i.MX clock driver (CVE-2022-3114).
CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1)
Foreman fixed CVE-2026-12542, a local command injection in foreman-tail that can run arbitrary commands.
SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742
SEC Consult disclosed local privilege escalation CVE-2026-13742 in Honeywell IQ MultiAccess, fixed in V27/V28 SP1.
[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM
Input Leap through 3.0.3 lets a local Windows user run commands as SYSTEM via unauthenticated IPC.
Sudo Security Vulnerability Lets Attackers Escalate Privileges
A Sudo flaw, CVE-2026-96512, lets local users bypass time-based sudoers rules via a crafted TZ variable.
CVE-2026-96512: sudo: TZ still affects NOTBEFORE/NOTAFTER
Sudo CVE-2026-96512 lets a local user shift sudoers time windows by abusing TZ.
Hackers Exploit Veeam Agent Vulnerability to Gain SYSTEM-Level Access on Windows
Public PoC for CVE-2026-32996 lets local users escalate to SYSTEM on vulnerable Veeam Agent for Windows.
2
ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability
ZDI discloses Linux Kernel Open vSwitch race condition (CVE-2026-74465) allowing low-privileged local attackers to escalate privileges, CVSS 7.8.
ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.
ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability
ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.
ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability
ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.
ZDI-26-615: (0Day) pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Zero Day Initiative disclosed an uncontrolled search path flaw in pdfforge PDF Architect's update service, allowing local privilege escalation (CVSS 7.8).
[local] Microsoft Edge 150.0.4078.48 - RCE
Exploit-DB publishes a local remote code execution exploit for Microsoft Edge 150.0.4078.48.