Low Severity
Published: Oct 30, 2026
Innora Security Research — Linux kernel vulnerability research: root-cause analysis, reproduction environments, exploitability primitives · @Innora_sg · ai0day.com
# Innora CVE Research
> **Innora Security Research** · [ai0day.com](https://ai0day.com) · Continuous vulnerability research & exploitability analysis
[English](README.md) | [简体中文](README.zh-CN.md)
## About
This repository publishes Innora's ongoing security research: root-cause
analysis, reproduction environments, exploitability primitives, and
mitigation guidance for vulnerabilities we investigate — primarily Linux
kernel networking bugs and related infrastructure.
Each CVE gets its own directory containing:
- **Root-cause analysis** — the exact code path, race window, and lifetime bug
- **Reproduction environment** — QEMU-based, self-contained, no external targets
- **Exploitability primitives** — what an attacker can realistically build
- **Patch matrix & defense guidance** — fixed versions and detection/mitigation
## Published Research
| CVE | Component | Class | Fixed In | Status |
|-----|-----------|-------|----------|--------|
| [CVE-2026-98432](CVE-2026-98432/) | Linux kernel IPv4 TCP | Use-after-free (race) | 6.12.113+ | ✅ Full chain verified |
## Methodology
Our research pipeline (the **ai0day pipeline**):
1. **Triage** — CVE analysis, affected-version mapping, exploitability scoring
2. **Reproduction** — deterministic trigger engineering (KASAN-verified)
3. **Primitive extraction** — heap layout, TOCTOU, OOB read/write analysis
4. **Chain validation** — end-to-end exploit primitive verification
5. **Disclosure** — coordinated with upstream fix availability
## Ethics & Policy
**Our primary purpose is cybersecurity research.** We publish research
technical details only — a complete weaponized exploit will not be made
public in the short term, as releasing one would be publishing a network
weapon, which we consider irresponsible.
- All research targets **already-patched** vulnerabilities (upstream fix
released before or alongside our publication)
- Reproduction environments are **self-contained** (QEMU VMs, custom-built
kernels) — nothing h