Medium Severity
Published: Nov 4, 2026
Innora Security Research — Synology DSM & Linux kernel CVE root-cause analysis, verified exploits and reproducible labs (C3RB3R ransomware initial-access CVEs)
# Innora CVE Research
> **Innora Security Research** · [ai0day.com](https://ai0day.com) · Continuous vulnerability research & exploitability analysis
[English](README.md) | [简体中文](README.zh-CN.md)
## About
This repository publishes Innora's ongoing security research: root-cause
analysis, reproduction environments, exploitability primitives, and
mitigation guidance for vulnerabilities we investigate — primarily Linux
kernel networking bugs and related infrastructure.
**Innora Security Research** ([innora.ai](https://innora.ai)) — vulnerability
research powered by the [ai0day.com](https://ai0day.com) LLM.
Each CVE gets its own directory containing:
- **Root-cause analysis** — the exact code path, race window, and lifetime bug
- **Reproduction environment** — QEMU-based, self-contained, no external targets
- **Exploitability primitives** — what an attacker can realistically build
- **Patch matrix & defense guidance** — fixed versions and detection/mitigation
## Published Research
Root-cause analysis, reproduction environments and exploitability primitives for
real-world vulnerabilities — including the initial-access CVEs behind the
C3RB3R / L0CK3D ransomware campaign against Synology NAS.
| CVE | Component | Class | Fixed In | Summary | Status |
|-----|-----------|-------|----------|---------|--------|
| [CVE-2026-98432](CVE-2026-98432/) | Linux kernel IPv4 TCP | Use-after-free (race) | 6.12.113+ | SYNACK rebuild races child-socket free | ✅ Full chain verified |
| [CVE-2024-10441](CVE-2024-10441/) | Synology DSM `synoplugind` | Env-var injection → root RCE (CWE-116) | DSM 7.2.2-72806-1+ | Login `account` breaks plugin-env framing; linker dirty write to cron | ✅ Full chain verified · C3RB3R initial access |
| [CVE-2026-13639](CVE-2026-13639/) | Synology DSM `libsyno-pam-login` | Zero-entropy session key → passwordless login (CWE-331) | DSM 7.2.2-72806-9+ | Session JWT key is 32 zero bytes; forge 1FA token, skip password | ✅ Root cause verified · C3RB3R initial