Skip to content

Commit c7ff1e9

Browse files
carlospolopHackTricks PEASS Wordlist Updater
carlospolop
and
HackTricks PEASS Wordlist Updater
authored
Auto-merge PR #682 (Chack Agent)
Co-authored-by: HackTricks PEASS Wordlist Updater <peass-wordlist-updater@hacktricks.xyz>
1 parent b930326 commit c7ff1e9

2 files changed

Lines changed: 31 additions & 8 deletions

File tree

‎linPEAS/builder/linpeas_parts/functions/kernel_cve_registry_checks.sh‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
# Title: Function - kernel_cve_registry_checks
22
# ID: kernel_cve_registry_checks
33
# Author: Carlos Polop
4-
# Last Update: 28-06-2026
4+
# Last Update: 17-08-2026
55
# Description: Evaluate declared kernel CVE rules using kernel version, arch, kernel config, sysctl and command prerequisites.
6-
# Description: Data source chunks KERNEL_CVE_DATA_1..22 are capped to 25 rows each.
6+
# Description: Data source chunks KERNEL_CVE_DATA_1..23 are capped to 25 rows each.
77
# License: GNU GPL
88
# Version: 1.0
99
# Functions Used: echo_not_found, print_3title, print_list
10-
# Global Variables: $E, $KERNEL_CVE_DATA_1, $KERNEL_CVE_DATA_2, $KERNEL_CVE_DATA_3, $KERNEL_CVE_DATA_4, $KERNEL_CVE_DATA_5, $KERNEL_CVE_DATA_6, $KERNEL_CVE_DATA_7, $KERNEL_CVE_DATA_8, $KERNEL_CVE_DATA_9, $KERNEL_CVE_DATA_10, $KERNEL_CVE_DATA_11, $KERNEL_CVE_DATA_12, $KERNEL_CVE_DATA_13, $KERNEL_CVE_DATA_14, $KERNEL_CVE_DATA_15, $KERNEL_CVE_DATA_16, $KERNEL_CVE_DATA_17, $KERNEL_CVE_DATA_18, $KERNEL_CVE_DATA_19, $KERNEL_CVE_DATA_20, $KERNEL_CVE_DATA_21, $KERNEL_CVE_DATA_22, $SED_GREEN, $SED_RED_YELLOW
10+
# Global Variables: $E, $KERNEL_CVE_DATA_1, $KERNEL_CVE_DATA_2, $KERNEL_CVE_DATA_3, $KERNEL_CVE_DATA_4, $KERNEL_CVE_DATA_5, $KERNEL_CVE_DATA_6, $KERNEL_CVE_DATA_7, $KERNEL_CVE_DATA_8, $KERNEL_CVE_DATA_9, $KERNEL_CVE_DATA_10, $KERNEL_CVE_DATA_11, $KERNEL_CVE_DATA_12, $KERNEL_CVE_DATA_13, $KERNEL_CVE_DATA_14, $KERNEL_CVE_DATA_15, $KERNEL_CVE_DATA_16, $KERNEL_CVE_DATA_17, $KERNEL_CVE_DATA_18, $KERNEL_CVE_DATA_19, $KERNEL_CVE_DATA_20, $KERNEL_CVE_DATA_21, $KERNEL_CVE_DATA_22, $KERNEL_CVE_DATA_23, $SED_GREEN, $SED_RED_YELLOW
1111
# Initial Functions: echo_not_found, print_3title, print_list
1212
# Generated Global Variables: $KERNEL_CVE_CFG_FILE, $KERNEL_CVE_CFG_SOURCE, $KERNEL_CVE_CFG_LINE, $KERNEL_CVE_CFG_KEY, $KERNEL_CVE_CFG_EXPR, $KERNEL_CVE_CFG_EXPECT, $KERNEL_CVE_CFG_OP, $KERNEL_CVE_CFG_CUR, $KERNEL_CVE_SYS_EXPR, $KERNEL_CVE_SYS_KEY, $KERNEL_CVE_SYS_OP, $KERNEL_CVE_SYS_VAL, $KERNEL_CVE_SYS_CUR, $KERNEL_CVE_REQS, $KERNEL_CVE_REQ, $KERNEL_CVE_REQ_LINES, $KERNEL_CVE_ID, $KERNEL_CVE_ID_NORM, $KERNEL_CVE_NAME, $KERNEL_CVE_TAGS, $KERNEL_CVE_RANK, $KERNEL_CVE_COMMENTS, $KERNEL_CVE_EXPL, $KERNEL_CVE_VERS, $KERNEL_CVE_VER_LINES, $KERNEL_CVE_ALT, $KERNEL_CVE_MIL, $KERNEL_CVE_TOKEN_OK, $KERNEL_CVE_MATCHES, $KERNEL_CVE_KERNEL_RELEASE, $KERNEL_CVE_KERNEL_VERSION, $KERNEL_CVE_KERNEL_ARCH, $KERNEL_CVE_KERNEL_OS, $KERNEL_CVE_VER, $KERNEL_CVE_OP, $KERNEL_CVE_REQVER, $KERNEL_CVE_CURVER, $KERNEL_CVE_CMP, $KERNEL_CVE_PRINT_ID, $KERNEL_CVE_PRINT_REASON, $KERNEL_CVE_ID_RAW, $KERNEL_CVE_ID_ITEM, $KERNEL_CVE_ID_OUT, $KERNEL_CVE_ALL_DATA, $KERNEL_CVE_PRINT_LINE
1313
# Fat linpeas: 0
@@ -257,17 +257,17 @@ kercve_run_registry() {
257257
fi
258258
done
259259

260-
KERNEL_CVE_ALL_DATA=$(printf "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s" \
260+
KERNEL_CVE_ALL_DATA=$(printf "%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s\n%s" \
261261
"$KERNEL_CVE_DATA_1" "$KERNEL_CVE_DATA_2" "$KERNEL_CVE_DATA_3" "$KERNEL_CVE_DATA_4" "$KERNEL_CVE_DATA_5" \
262262
"$KERNEL_CVE_DATA_6" "$KERNEL_CVE_DATA_7" "$KERNEL_CVE_DATA_8" "$KERNEL_CVE_DATA_9" "$KERNEL_CVE_DATA_10" \
263263
"$KERNEL_CVE_DATA_11" "$KERNEL_CVE_DATA_12" "$KERNEL_CVE_DATA_13" "$KERNEL_CVE_DATA_14" "$KERNEL_CVE_DATA_15" \
264264
"$KERNEL_CVE_DATA_16" "$KERNEL_CVE_DATA_17" "$KERNEL_CVE_DATA_18" "$KERNEL_CVE_DATA_19" "$KERNEL_CVE_DATA_20" \
265-
"$KERNEL_CVE_DATA_21" "$KERNEL_CVE_DATA_22")
265+
"$KERNEL_CVE_DATA_21" "$KERNEL_CVE_DATA_22" "$KERNEL_CVE_DATA_23")
266266

267267
print_list "Operating system ............. $KERNEL_CVE_KERNEL_OS\n"
268268
print_list "Kernel release ............... $KERNEL_CVE_KERNEL_RELEASE\n"
269269
print_list "Comparable version ........... $KERNEL_CVE_KERNEL_VERSION\n"
270-
print_list "Data chunk limit ............. max 25 rows per KERNEL_CVE_DATA_* variable (1..22)\n"
270+
print_list "Data chunk limit ............. max 25 rows per KERNEL_CVE_DATA_* variable (1..23)\n"
271271
if [ -n "$KERNEL_CVE_CFG_SOURCE" ]; then
272272
print_list "Kernel config source ......... $KERNEL_CVE_CFG_SOURCE\n"
273273
else

‎linPEAS/builder/linpeas_parts/variables/kernel_cve_registry_data.sh‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
# ID: kernel_cve_registry_data
33
# Author: Carlos Polop
44
# Contributor: Arjay Saguisa
5-
# Last Update: 06-07-2026
5+
# Last Update: 17-08-2026
66
# Description: Embedded kernel exploit matching datasets extracted from linux-exploit-suggester and linux-exploit-suggester-2 examples. Data is split across KERNEL_CVE_DATA_1..X with a maximum of 25 rows per env variable. This file also stores reference-only CVE tokens found in example repos when no explicit suggester matching rule exists.
77
# License: GNU GPL
88
# Version: 1.0
99
# Functions Used:
1010
# Global Variables:
1111
# Initial Functions:
12-
# Generated Global Variables: $KERNEL_CVE_DATA_1, $KERNEL_CVE_DATA_2, $KERNEL_CVE_DATA_3, $KERNEL_CVE_DATA_4, $KERNEL_CVE_DATA_5, $KERNEL_CVE_DATA_6, $KERNEL_CVE_DATA_7, $KERNEL_CVE_DATA_8, $KERNEL_CVE_DATA_9, $KERNEL_CVE_DATA_10, $KERNEL_CVE_DATA_11, $KERNEL_CVE_DATA_12, $KERNEL_CVE_DATA_13, $KERNEL_CVE_DATA_14, $KERNEL_CVE_DATA_15, $KERNEL_CVE_DATA_16, $KERNEL_CVE_DATA_17, $KERNEL_CVE_DATA_18, $KERNEL_CVE_DATA_19, $KERNEL_CVE_DATA_20, $KERNEL_CVE_DATA_21, $KERNEL_CVE_DATA_22
12+
# Generated Global Variables: $KERNEL_CVE_DATA_1, $KERNEL_CVE_DATA_2, $KERNEL_CVE_DATA_3, $KERNEL_CVE_DATA_4, $KERNEL_CVE_DATA_5, $KERNEL_CVE_DATA_6, $KERNEL_CVE_DATA_7, $KERNEL_CVE_DATA_8, $KERNEL_CVE_DATA_9, $KERNEL_CVE_DATA_10, $KERNEL_CVE_DATA_11, $KERNEL_CVE_DATA_12, $KERNEL_CVE_DATA_13, $KERNEL_CVE_DATA_14, $KERNEL_CVE_DATA_15, $KERNEL_CVE_DATA_16, $KERNEL_CVE_DATA_17, $KERNEL_CVE_DATA_18, $KERNEL_CVE_DATA_19, $KERNEL_CVE_DATA_20, $KERNEL_CVE_DATA_21, $KERNEL_CVE_DATA_22, $KERNEL_CVE_DATA_23
1313
# Fat linpeas: 0
1414
# Small linpeas: 1
1515

@@ -651,3 +651,26 @@ CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.13,ver<6.18.31,cmd:[ "$(
651651
CVE-2026-46333 ptrace exit-race pkg=linux-kernel,ver>=6.19,ver<7.0.8,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] 1 Upstream issue introduced in 4.10; fixed in 7.0.8; mitigated by kernel.yama.ptrace_scope >= 2
652652
EOF_DATA_22
653653
)"
654+
655+
KERNEL_CVE_DATA_23="$(cat <<'EOF_DATA_23'
656+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=2.6.39,ver<5.10.261,CONFIG_FUTEX_PI=y 1 Fixed in stable 5.10.261; priority-inheritance futexes must be enabled
657+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=5.11,ver<5.15.212,CONFIG_FUTEX_PI=y 1 Fixed in stable 5.15.212; priority-inheritance futexes must be enabled
658+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=5.16,ver<6.1.175,CONFIG_FUTEX_PI=y 1 Fixed in stable 6.1.175; priority-inheritance futexes must be enabled
659+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=6.2,ver<6.6.140,CONFIG_FUTEX_PI=y 1 Fixed in stable 6.6.140; priority-inheritance futexes must be enabled
660+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=6.7,ver<6.12.86,CONFIG_FUTEX_PI=y 1 Fixed in stable 6.12.86; priority-inheritance futexes must be enabled
661+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=6.13,ver<6.18.27,CONFIG_FUTEX_PI=y 1 Fixed in stable 6.18.27; priority-inheritance futexes must be enabled
662+
CVE-2026-43499 GhostLock rtmutex UAF pkg=linux-kernel,ver>=6.19,ver<7.0.4,CONFIG_FUTEX_PI=y 1 Fixed in stable 7.0.4 and mainline 7.1; priority-inheritance futexes must be enabled
663+
CVE-2026-53362 IPv6 fraggap out-of-bounds write pkg=linux-kernel,ver>=6.0,ver<6.1.177,CONFIG_IPV6=[my] 1 Fixed in stable 6.1.177; IPv6 must be enabled
664+
CVE-2026-53362 IPv6 fraggap out-of-bounds write pkg=linux-kernel,ver>=6.2,ver<6.6.144,CONFIG_IPV6=[my] 1 Fixed in stable 6.6.144; IPv6 must be enabled
665+
CVE-2026-53362 IPv6 fraggap out-of-bounds write pkg=linux-kernel,ver>=6.7,ver<6.12.95,CONFIG_IPV6=[my] 1 Fixed in stable 6.12.95; IPv6 must be enabled
666+
CVE-2026-53362 IPv6 fraggap out-of-bounds write pkg=linux-kernel,ver>=6.13,ver<6.18.38,CONFIG_IPV6=[my] 1 Fixed in stable 6.18.38; IPv6 must be enabled
667+
CVE-2026-53362 IPv6 fraggap out-of-bounds write pkg=linux-kernel,ver>=6.19,ver<7.1.3,CONFIG_IPV6=[my] 1 Fixed in stable 7.1.3 and mainline 7.2-rc1; IPv6 must be enabled
668+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=4.11,ver<5.15.212,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 5.15.212; requires an XFS filesystem with reflink enabled
669+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=5.16,ver<6.1.178,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 6.1.178; requires an XFS filesystem with reflink enabled
670+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=6.2,ver<6.6.145,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 6.6.145; requires an XFS filesystem with reflink enabled
671+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=6.7,ver<6.12.96,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 6.12.96; requires an XFS filesystem with reflink enabled
672+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=6.13,ver<6.18.39,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 6.18.39; requires an XFS filesystem with reflink enabled
673+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=6.19,ver<7.1.4,CONFIG_XFS_FS=[my],cmd:grep -qw xfs /proc/mounts 1 Fixed in stable 7.1.4; requires an XFS filesystem with reflink enabled
674+
CVE-2026-64600 RefluXFS stale mapping race pkg=linux-kernel,ver>=7.2,ver<7.3,CONFIG_XFS_FS=[my],cmd:uname -r 2>/dev/null | grep -Eq '^7\.2\.0-rc[123]([-.]|$)',cmd:grep -qw xfs /proc/mounts 1 Fixed in mainline 7.2-rc4; requires an XFS filesystem with reflink enabled
675+
EOF_DATA_23
676+
)"

0 commit comments

Comments
 (0)