What I found, what I wrote, and who gets credit for what. Original research and CVEs are separated from proof-of-concept exploits for other people's bugs — on purpose. Read the difference.
Ubuntu's AppArmor 5.0 "fine grained ipv4/ipv6" SAUCE dereferences a pointer one branch before it's assigned. Any unprivileged user oopses the kernel with one bind() under the stock unprivileged_userns profile — full host DoS where panic_on_oops=1. Ubuntu-only; not upstream.
The v4 fix f4c50a4034 does not cover esp6_input. Same MSG_SPLICE_PAGES no-COW write, reachable over IPv6 — an incomplete-fix finding.
TP-Link firmware decryption at scale — 52,609 images. The verification public key is also the decryption key: the AES key/IV fall out of the RSA-PSS salt. No private key required.
Read root-owned files as an unprivileged user. Races the exit of a setuid binary (ssh-keysign / chage) through the __ptrace_may_access() mm-NULL window and lifts its open fds with pidfd_getfd(2) — stealing SSH host private keys and /etc/shadow.
Unprivileged Linux LPE via xfrm ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path — a page-cache write into any readable file. Drops a passwordless uid-0 line into /etc/passwd and sus in. Same class as Copy Fail (CVE-2026-31431), different subsystem.