linneman
labs
building
breaking
observing
content
···
verified
home
/ exploit
Exploit
2026.09.02
NetworkManager-l2tp: A Newline to Root
An unprivileged D-Bus call writes a root-parsed VPN config value. One newline, root code execution, confinement escape.
2026.08.05
Pi-hole: root with extra steps
Nine ways to compromise Pi-hole: five paths from a web session to code-exec, three LPEs to root-exec, one file-disclosure