Skip to content

About

Linux local privilege escalation PoCs and mitigations.

Resources

Readme
Activity

Stars

1 star

Watchers

0 watching

Forks

1 fork
Report repository
BranchesTags

Repository files navigation

Linux LPE Research PoCs

This repository contains Linux local privilege escalation (LPE) proof-of-concept programs. Most of the code explores a family of kernel bugs where an unprivileged process can make the kernel modify page-cache pages that should only be readable. Several PoCs then target a readable setuid-root binary, such as /usr/bin/su, so the corrupted cached copy executes attacker-controlled code as root.

Treat this repository as security research material. Do not run these programs on production hosts. Several PoCs intentionally corrupt the page cache of privileged files and may leave the machine in an unsafe or unstable state until the cache is evicted or the host is rebooted. Use disposable virtual machines only.

For defensive hunting and incident-response indicators, see IoC.md.

Repository Contents

Path Summary
CIFSwitch/poc.c C translation of the public CIFSwitch PoC for CVE-2026-46243. It abuses forged cifs.spnego key descriptions, the cifs.upcall request-key path, namespace switching, and NSS loading to get root code execution on affected systems. This is not a page-cache corruption bug.
CopyFail/poc.c Very small PoC using AF_ALG, authencesn(hmac(sha256),cbc(aes)), splice, and /usr/bin/su. It demonstrates page-cache modification through a kernel crypto path.
DirtyFrag/poc.c Combined LPE chain. It first tries an XFRM/ESP path that patches /usr/bin/su in page cache with a tiny root-shell ELF. It also contains an rxrpc/rxkad fallback that can rewrite /etc/passwd in page cache and then drive su through a PTY.
DirtyDecrypt/poc.c rxgk/AF_RXRPC page-cache write PoC. The file header identifies the core issue as missing copy-on-write protection in rxgk_decrypt_skb(), where in-place decryption can touch page-cache backed socket fragments. It uses a byte-by-byte sliding window to write a tiny ELF into a readable setuid-root binary.
DirtyCBC/poc.c RxGK chosen-plaintext page-cache PoC for the same rxgk_decrypt_skb() mutability class. It uses a controlled RxGK server key and CBC/CTS block construction to write chosen plaintext into a readable setuid-root binary. This source needs keyutils and OpenSSL development headers (-lkeyutils -lcrypto), which the make pocs target links automatically.
Fragnesia/poc.c ESP-in-TCP/XFRM page-cache replacement PoC. It uses namespaces, XFRM state, TCP ESP encapsulation, and splice to transform copied file bytes in page cache. The current main() targets /usr/bin/su with a 192-byte payload.
FragnesiaV2/poc.c Follow-up ESP-in-TCP PoC focused on skb_segment() behavior. It builds a sender/middle/receiver namespace topology where GRO/GSO segmentation strips shared-fragment metadata before ESP decryption mutates page-cache backed fragments.
PinTheft/poc.c RDS zerocopy refcount bug plus io_uring fixed-buffer stale page pointer. It steals references from a pinned anonymous page, frees it, reclaims it as setuid binary page cache, then writes through the stale io_uring buffer pointer. The underlying RDS issue is CVE-2026-43494; this repo's chain also depends on IORING_REGISTER_CLONE_BUFFERS, so kernel version and RDS autoload policy both matter.
SSH-Keysign-pwn/ Separate but related LPE/information disclosure research. It demonstrates pidfd_getfd() file-descriptor theft from exiting privileged helpers when task->mm == NULL but sensitive file descriptors are still open. Includes targets for ssh-keysign, chage, and a controlled vulnerable setuid helper.

The top-level Makefile builds the main standalone C PoCs into build/ and delegates SSH-Keysign-pwn/ to its own Makefile.

Usage

Build all standalone PoCs into build/:

make pocs

This compiles each top-level PoC into the build/ directory:

build/cifswitch
build/copyfail
build/dirtyfrag
build/dirtydecrypt
build/dirtycbc
build/fragnesia
build/fragnesia-v2
build/pintheft

build/dirtycbc needs the keyutils and OpenSSL development packages installed (e.g. libkeyutils-dev and libssl-dev on Debian/Ubuntu).

Build a single PoC into build/:

make build/copyfail        # or build/cifswitch, build/dirtyfrag, etc.

Build everything, including the SSH-Keysign-pwn/ tools (these build inside SSH-Keysign-pwn/, not build/):

make            # same as: make all  -> pocs + ssh-keysign

Options:

make STATIC=1   # link statically (-static)
make CC=clang   # use a different compiler
make help       # list targets and options

Remove all build artifacts:

make clean

Build only DirtyCBC into build/:

make dirtycbc

If keyutils or OpenSSL live in a non-standard location, override the link libs:

make dirtycbc DIRTYCBC_LIBS="-L/opt/lib -lkeyutils -lcrypto"

Public Advisory Map

Repository item Public identifier or advisory Notes
CIFSwitch/poc.c CVE-2026-46243 Kernel CIFS/cifs-utils trust-boundary issue. Exploitability depends on a vulnerable kernel, an affected cifs-utils helper with a cifs.spnego request-key rule, CIFS module availability, unprivileged namespaces, and LSM policy.
CopyFail/poc.c CVE-2026-31431 Public advisories describe an algif_aead/AF_ALG page-cache write. NVD marks this CVE as present in CISA's Known Exploited Vulnerabilities catalog.
DirtyFrag/poc.c CVE-2026-43284 and CVE-2026-43500 ESP/XFRM and RxRPC issues. Ubuntu states the module families are independent, so disabling only ESP or only RxRPC leaves the other path exposed.
Fragnesia/poc.c, FragnesiaV2/poc.c CVE-2026-46300 ESP-in-TCP/XFRM issue covered by the same ESP module mitigation as Dirty Frag. Red Hat tracks Fragnesia in the Dirty Frag advisory set.
DirtyDecrypt/poc.c, DirtyCBC/poc.c Commonly associated in public reporting with CVE-2026-31635 NVD currently describes an RxGK RESPONSE length-check issue and links the public V12 DirtyDecrypt PoC. Treat the CVE mapping as advisory context and verify affected kernel/config status with vendor guidance, especially CONFIG_RXGK.
PinTheft/poc.c CVE-2026-43494 RDS zerocopy op_nents cleanup/refcount issue. Ubuntu says default installations are mitigated unless RDS autoload or boot-time loading has been explicitly enabled.
SSH-Keysign-pwn/ CVE-2026-46333 pidfd_getfd()/ptrace access issue during process exit; Ubuntu's documented mitigation uses kernel.yama.ptrace_scope=2.

Main Vulnerability Class

The main class represented here is page-cache corruption from unsafe kernel mutation of shared or file-backed pages.

The Linux page cache stores file contents in memory. Those pages can be shared by many readers, memory mappings, and executable loaders. A process may have only read permission to a file, but if it can cause the kernel to attach that file's page-cache pages to another subsystem, the subsystem must not modify those pages in place unless it first owns a private copy.

The vulnerable shape is:

  1. An unprivileged process opens a sensitive but readable file, often a setuid-root executable.
  2. The process uses interfaces such as splice, vmsplice, network sockets, packet fragments, AF_ALG, AF_RXRPC, XFRM/ESP, RDS zerocopy, or io_uring fixed buffers to route the file-backed page into kernel code.
  3. A kernel path assumes the buffer is private and performs an in-place write, decryption, authentication transform, DMA-style read, or refcount/lifetime operation.
  4. The write lands in the page cache, not through normal filesystem write permission checks.
  5. If the modified page belongs to a setuid-root binary, executing that binary can execute the modified cached bytes with elevated privileges.

This is similar in impact to the Dirty COW and Dirty Pipe family: the attacker does not need normal write permission to the target file, because the bug is in how the kernel handles shared memory, page references, or copied pages after the file has already been read into cache.

Some PoCs corrupt only cached memory and not the on-disk file. That does not make the issue harmless. The kernel may execute or serve the cached bytes until the page is evicted, invalidated, or the system is rebooted.

Patterns Demonstrated

In-place crypto/network transforms

DirtyDecrypt, DirtyCBC, DirtyFrag, Fragnesia, FragnesiaV2, and CopyFail focus on cases where page-cache backed socket fragments reach crypto or networking code. Risky operations include decrypting before authentication succeeds, using skb fragments without a copy-on-write guard, or losing metadata that marks a fragment as shared.

Mitigation at the kernel level is to copy before modifying:

  • Preserve shared-fragment metadata across GRO, GSO, segmentation, coalescing, and encapsulation paths.
  • Before decrypting or otherwise mutating skb data, ensure the skb owns writable private memory. Kernel fixes commonly use copy-on-write helpers or force a linear/private copy before in-place transforms.
  • Prefer authenticate-then-decrypt, or decrypt into scratch/private memory and copy results only after authentication succeeds.
  • Treat data imported from splice, vmsplice, and MSG_SPLICE_PAGES as potentially file-backed and immutable unless a private copy is made.

Refcount and stale page-pointer bugs

PinTheft demonstrates a different route to the same result: page lifetime confusion. A zerocopy error path drops references incorrectly, then io_uring keeps a stale struct page * that later points at a page reused as page cache.

Mitigation at the kernel level is strict page ownership accounting:

  • Pair every page pin/get with exactly one put on every success and error path.
  • Clear scatter-gather entries and counters when ownership is transferred or an operation is aborted.
  • Do not keep raw page pointers usable after the corresponding lifetime has ended.
  • Validate fixed-buffer and DMA-like operations against live, still-pinned pages at submission and completion time.

Exiting-task file-descriptor theft

SSH-Keysign-pwn is not a page-cache corruption bug. It demonstrates a privileged file descriptor leak through pidfd_getfd() during process exit. The described race is that the target has already dropped its memory descriptor (task->mm == NULL) but still has privileged file descriptors open.

Mitigation for this class includes:

  • Kernel-side access checks must still enforce dumpability and credential restrictions for exiting tasks.
  • Privileged helper programs should drop privilege before opening sensitive files whenever possible.
  • Close sensitive descriptors before dropping privileges or before any error path that can exit under attacker influence.
  • Use O_CLOEXEC, FD_CLOEXEC, and close_range() defensively, but do not rely on close-on-exec to fix descriptors that remain open during exit.

Trusted upcall namespace/NSS confusion

CIFSwitch is a separate CIFS/cifs-utils trust-boundary bug. A forged userspace request_key("cifs.spnego", ...) description can cause the normal request-key rule to launch cifs.upcall as root. Affected helper versions trust fields such as pid, uid, creduid, and upcall_target as if they came from kernel CIFS state. With upcall_target=app, the helper can switch into an attacker-controlled namespace and perform NSS account lookup before its final privilege drop, allowing a namespace-local libnss_*.so.2 to run as root. The kernel-side fix adds validation so cifs.spnego descriptions are accepted only when CIFS is requesting the key through its private spnego_cred.

Mitigation for this class includes:

  • Install a kernel with the CVE-2026-46243 CIFS fix or a vendor stable backport that rejects userspace cifs.spnego descriptions.
  • Do not install cifs-utils on hosts that do not need CIFS/SMB Kerberos upcalls.
  • Override the cifs.spnego request-key rule to negate requests when Kerberos CIFS mounts are not required.
  • Disable or restrict unprivileged user namespaces where compatible with workloads.
  • Use SELinux/AppArmor policies that block the namespace switch or malicious NSS module load path.

Operational Mitigations

The primary mitigation is to run a kernel that contains the vendor fixes for the affected subsystem. Workarounds can reduce exposure, but they should not be treated as complete fixes.

PoC Blocking Mitigations

The commands below are practical controls for blocking the PoC paths in this repository on systems where the affected features are loadable modules or controlled by sysctl. They are intended as temporary mitigations until patched kernel packages are installed.

Important caveats:

  • If a feature is built into the kernel instead of loaded as a module, a /etc/modprobe.d/ rule and rmmod cannot disable it.
  • If a module is already in use, rmmod may fail. Rebooting after adding the deny rule is the usual way to enforce it.
  • These controls can break legitimate workloads: CIFS/SMB mounts, IPsec VPNs, AFS/RxRPC users, RDS users, applications using AF_ALG AEAD acceleration, debuggers, and workloads that need io_uring.
  • Do not use drop_caches as a security fix. It can clear memory-only page-cache corruption after blocking the trigger, but a compromised host still needs incident response.

Kernel Modules and Runtime Loading

Linux features may be built into the kernel (=y) or shipped as loadable modules (=m). Built-in code is always present and cannot be removed with rmmod or blocked with a simple /etc/modprobe.d/ rule.

Loadable modules are often pulled in on demand. A normal user process that opens an AF_ALG, AF_RXRPC, RDS, ESP/IPsec, or similar interface can cause the kernel to request the matching module if policy allows it. This is expected Linux behavior, not automatically suspicious: legitimate VPNs, AFS/RxRPC users, RDS users, crypto users, and other software may load these modules at runtime.

If a module is not loaded, it may simply mean the feature is unused, built into the kernel, unavailable, disabled by policy, blacklisted, or blocked by missing dependencies.

For this repository, the relevant module families are:

  • algif_aead / AF_ALG: userspace crypto interfaces used by the AF_ALG crypto PoCs.
  • cifs: CIFS/SMB client used by CIFSwitch through the cifs.spnego request-key upcall path.
  • esp4, esp6, and XFRM: IPsec/ESP paths used by the Fragnesia and DirtyFrag ESP paths.
  • rxrpc / RxGK: RxRPC paths used by DirtyDecrypt, DirtyCBC, and DirtyFrag's fallback. DirtyDecrypt and DirtyCBC also need CONFIG_RXGK.
  • rds / rds_tcp: RDS zerocopy path used by PinTheft.
  • io_uring: normally kernel core code or controlled by sysctl rather than a removable module, but still a required PinTheft primitive.

lsmod and /proc/modules only show modules that are currently loaded. They do not show features compiled into the kernel, and they do not prove that an unloaded module cannot be loaded later. Kernel config (/boot/config-* or /proc/config.gz) answers whether a feature is built in, modular, or absent. modinfo <module> can show whether a module exists on disk and which aliases may trigger autoloading.

Blocking a module with an install <module> /bin/false rule prevents future autoloads, but it does not unload an already active module. If the module is already loaded and in use, unloading may fail; rebooting after adding the block is the cleanest way to verify the policy is enforced.

Check whether relevant code is modular or built in:

grep -E 'CONFIG_CIFS=|CONFIG_CRYPTO_USER_API_AEAD=|CONFIG_INET_ESP=|CONFIG_INET6_ESP=|CONFIG_AF_RXRPC=|CONFIG_RXGK=|CONFIG_RDS=|CONFIG_RDS_TCP=|CONFIG_IO_URING=' /boot/config-$(uname -r) 2>/dev/null || \
zgrep -E 'CONFIG_CIFS=|CONFIG_CRYPTO_USER_API_AEAD=|CONFIG_INET_ESP=|CONFIG_INET6_ESP=|CONFIG_AF_RXRPC=|CONFIG_RXGK=|CONFIG_RDS=|CONFIG_RDS_TCP=|CONFIG_IO_URING=' /proc/config.gz 2>/dev/null

=m means module, =y means built in, and a missing option normally means the feature is unavailable.

CopyFail

Blocks CopyFail/poc.c by disabling the algif_aead userspace AEAD interface used through AF_ALG.

sudo sh -c 'printf "install algif_aead /bin/false\n" > /etc/modprobe.d/disable-algif_aead.conf'
sudo rmmod algif_aead 2>/dev/null || true
grep -qE '^algif_aead ' /proc/modules && echo "algif_aead is still loaded" || echo "algif_aead is not loaded"

On Debian/Ubuntu systems, regenerate initramfs if the module can be loaded during early boot:

sudo update-initramfs -u -k all

If algif_aead or AF_ALG is built into the kernel, use the vendor kernel update. Red Hat documents boot-time alternatives such as initcall_blacklist=algif_aead_init, initcall_blacklist=af_alg_init, or initcall_blacklist=crypto_authenc_esn_module_init; validate those against the specific distribution before deploying.

CIFSwitch

Blocks CIFSwitch/poc.c by removing one or more prerequisites: the CIFS kernel client, the cifs.spnego request-key rule, an affected cifs-utils helper, or unprivileged user namespaces. The kernel fix is the correct long-term mitigation. The public writeup describes affected cifs-utils versions as nominally 6.14 and later, with some older builds affected when downstream backports introduced the relevant namespace-switch behavior.

Check whether the request-key rule can dispatch to cifs.upcall:

grep -R "cifs.spnego" /etc/request-key.conf /etc/request-key.d 2>/dev/null

If CIFS/SMB mounts are not required, block future module loading and unload the module if possible:

sudo sh -c 'printf "install cifs /bin/false\n" > /etc/modprobe.d/disable-cifs.conf'
sudo rmmod cifs 2>/dev/null || true
grep -qE '^cifs ' /proc/modules && echo "cifs is still loaded" || echo "cifs is not loaded"

If CIFS is built into the kernel, use the vendor kernel update or disable the userspace upcall path when it is not needed. To negate cifs.spnego requests instead of launching cifs.upcall, adjust the keyctl path for the distribution and install an override such as:

sudo sh -c 'printf "%s\n" "create cifs.spnego * * /usr/sbin/keyctl negate %k 30 %S" > /etc/request-key.d/cifs.spnego.conf'

Removing cifs-utils is also effective on systems that do not use CIFS/SMB mounts. Disabling unprivileged user namespaces can block the public PoC path, but it may break rootless containers, browsers, Flatpak, and CI workloads.

DirtyFrag, DirtyDecrypt, DirtyCBC, Fragnesia, and FragnesiaV2

Blocks the XFRM/ESP and RxRPC paths used by DirtyFrag/poc.c, DirtyDecrypt/poc.c, DirtyCBC/poc.c, Fragnesia/poc.c, and FragnesiaV2/poc.c.

sudo sh -c 'printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /etc/modprobe.d/dirtyfrag.conf'
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true
grep -qE '^(esp4|esp6|rxrpc) ' /proc/modules && echo "affected modules are still loaded" || echo "affected modules are not loaded"

On Debian/Ubuntu systems:

sudo update-initramfs -u -k all

If the system uses IPsec, ESP, StrongSwan, AFS, or another RxRPC application, expect breakage. For Fragnesia-only testing, esp4 and esp6 are the key modules; DirtyFrag also needs rxrpc blocked because its fallback path uses AF_RXRPC. DirtyDecrypt and DirtyCBC also require RxGK support (CONFIG_RXGK); if RxGK is not compiled or loadable, those two PoCs are not reachable as written.

After applying the block and unloading modules on a test host, optionally flush page cache:

sync
sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'

PinTheft

Blocks PinTheft/poc.c by disabling RDS/RDS-TCP and, optionally, unprivileged or all io_uring creation. The PoC needs both RDS TCP zerocopy and io_uring fixed buffers, so disabling either side can break this path.

This mitigation is derived from the PoC prerequisites and the upstream RDS fix context. It is not a substitute for the kernel patch that fixes the RDS zerocopy error path. If a system legitimately uses RDS, patch instead of disabling the protocol.

The underlying RDS bug is tracked as CVE-2026-43494. Ubuntu's advisory says default Ubuntu installations are mitigated because rare network protocols, including RDS, are blocked from automatic loading. Systems where RDS is already loaded, explicitly loaded at boot, or allowed to autoload should be treated as exposed until patched.

Version gate: this PoC specifically uses full-range IORING_REGISTER_CLONE_BUFFERS to keep a cloned registered-buffer reference alive while the original ring is destroyed. That io_uring operation was added after Linux 6.8; the public io_uring documentation places full-range clone support at Linux 6.12. Therefore the Ubuntu 24.04 LTS GA/default kernel line based on upstream 6.8 is not affected by this PinTheft chain as written. Systems running Ubuntu HWE, mainline, vendor, or custom kernels at 6.12 or newer should check the runtime kernel and still apply the RDS/io_uring mitigations if RDS is not required.

Quick kernel check:

uname -r

As a rule of thumb, 6.8.0-* Ubuntu 24.04 GA kernels do not have the required clone-buffer operation. Kernels 6.12 and newer, or downstream kernels that backported IORING_REGISTER_CLONE_BUFFERS, should be treated as in scope.

sudo sh -c 'printf "install rds /bin/false\ninstall rds_tcp /bin/false\n" > /etc/modprobe.d/pintheft.conf'
sudo rmmod rds_tcp rds 2>/dev/null || true
grep -qE '^(rds|rds_tcp) ' /proc/modules && echo "RDS modules are still loaded" || echo "RDS modules are not loaded"
grep -rqE '^alias net-pf-21 off' /etc/modprobe.d/ && echo "RDS autoload is blocked" || echo "RDS autoload may be possible"
grep -rqE '^rds' /etc/modules-load.d/ /usr/lib/modules-load.d/ && echo "RDS may load at boot" || echo "RDS is not configured for boot-time loading"

If RDS over InfiniBand is not required either, also block rds_rdma.

To disable new io_uring instances for all users:

sudo sh -c 'printf "kernel.io_uring_disabled = 2\n" > /etc/sysctl.d/99-disable-io_uring.conf'
sudo sysctl -p /etc/sysctl.d/99-disable-io_uring.conf

Use kernel.io_uring_disabled = 1 instead if privileged users or members of a configured kernel.io_uring_group still need to create rings.

SSH-Keysign-pwn

Blocks the SSH-Keysign-pwn PoCs by restricting unprivileged ptrace access, which also affects pidfd_getfd() access checks.

sudo sh -c 'printf "kernel.yama.ptrace_scope = 2\n" > /etc/sysctl.d/99-CVE-2026-46333.conf'
sudo sysctl -p /etc/sysctl.d/99-CVE-2026-46333.conf

Value 2 blocks normal unprivileged users without CAP_SYS_PTRACE from attaching to other processes. Value 3 is stricter and disables ptrace attaches more broadly, but it cannot be lowered again without reboot on systems that enforce that rule. This affects tools such as gdb, strace -p, and gcore.

Additional Hardening

Many networking PoCs in this repository become easier when unprivileged users can create user and network namespaces. Where compatible with workloads, disable or restrict unprivileged user namespaces:

sudo sh -c 'printf "kernel.unprivileged_userns_clone = 0\n" > /etc/sysctl.d/99-disable-unpriv-userns.conf'
sudo sysctl -p /etc/sysctl.d/99-disable-unpriv-userns.conf

On Ubuntu releases with AppArmor user namespace restrictions, prefer the AppArmor-controlled policy when you need selected applications such as browsers or container tools to keep working:

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1

For container platforms and CI runners, also apply seccomp/LSM rules that deny untrusted workloads access to unused high-risk interfaces such as AF_ALG, AF_RXRPC, AF_RDS, NETLINK_XFRM, io_uring_setup, io_uring_register, keyctl, pidfd_getfd, unshare, setns, splice, and vmsplice.

Recommended hardening steps:

  • Keep the kernel and distribution security updates current, especially for networking, XFRM/IPsec, RXRPC, RDS, io_uring, and pidfd/ptrace fixes.
  • Disable unprivileged user namespaces where they are not required. Many of these PoCs rely on CLONE_NEWUSER plus CLONE_NEWNET to gain namespaced network capabilities.
  • Restrict unneeded kernel attack surface. If your workloads do not need them, disable or avoid loading modules and protocol families such as RXRPC, RDS, RDS-TCP, uncommon IPsec/XFRM features, and ESP-in-TCP.
  • Disable or restrict unprivileged io_uring on systems that do not need it. On kernels that support it, kernel.io_uring_disabled=1 restricts unprivileged use and kernel.io_uring_disabled=2 disables it more broadly.
  • Reduce the number of setuid-root binaries. Remove setuid bits from tools that are not needed, and mount user-writable filesystems with nosuid.
  • In containers or sandboxes, use seccomp/LSM policy to block high-risk interfaces for untrusted code: unshare, setns, keyctl, pidfd_getfd, io_uring_setup, io_uring_register, splice, vmsplice, AF_ALG, AF_RXRPC, AF_RDS, and NETLINK_XFRM, where compatible with the workload.
  • Monitor for suspicious combinations: unprivileged namespace creation followed by XFRM netlink operations, RXRPC/RDS socket use, repeated splice or vmsplice into sockets, large numbers of pidfd_getfd() attempts, or sudden execution of setuid binaries after unusual networking activity.
  • Monitor for CIFSwitch-specific combinations: unprivileged namespace creation, request_key("cifs.spnego", ...), /usr/sbin/cifs.upcall launched by /sbin/request-key, namespace-local bind mounts over nsswitch.conf and NSS module directories, and new /etc/sudoers.d/cifs-upcall-poc-* files.

If exploitation is suspected, treat the host as compromised. Rebooting may clear memory-only page-cache corruption, but it does not remove any persistence an attacker may have installed after gaining root. Verify packages from trusted media, rotate credentials, rotate SSH host keys if they may have been exposed, and review privileged helper logs and authentication records.

Guidance for Patch Review

When reviewing kernel patches for this vulnerability class, look for properties rather than only for the specific trigger:

  • No page-cache backed or user-controlled page fragment is modified in place without an explicit private-copy step.
  • Shared-fragment markers survive segmentation, coalescing, forwarding, and encapsulation.
  • Authentication failures cannot still leave decrypted or transformed data in shared pages.
  • Error paths clear ownership state before generic cleanup code runs.
  • Long-lived kernel handles, such as registered buffers, cannot outlive the page references that make them valid.
  • Privilege and ptrace checks do not become weaker during process exit.

These bugs are usually boundary bugs: the vulnerable subsystem is not always the one that opened the sensitive file. Effective fixes must preserve page ownership and mutability rules across subsystem boundaries.

References

About

Linux local privilege escalation PoCs and mitigations.

Resources

Readme
Activity

Stars

1 star

Watchers

0 watching

Forks

1 fork
Report repository

Releases

Packages

Contributors

Languages