aviralyash27
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
ExploitDBLinux nf_tables 6.19.3 - Local Privilege Escalation
ExploitDB exploitPublished 2026-05-04ExploitCVE-2026-232311 file
Analysis
Technical assessment
A C exploit targeting CVE-2026-23231, a use-after-free vulnerability in the Linux kernel's nf_tables subsystem. The code triggers the vulnerability by causing a hook registration failure, reclaims the freed memory with a heap spray, attempts to leak kernel addresses via a race condition, and ultimately aims to overwrite modprobe_path for local privilege escalation.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a C source file implementing a local privilege escalation exploit for CVE-2026-23231. It uses documented kernel exploitation techniques (UAF, heap spray, payload withheld) to gain root. No concealed backdoor, deceptive payload, or unrelated harmful behavior was observed. The code is self-contained, well-commented, and its actions are consistent with the stated exploit goal.
Classification basis and observed behavior
Classification basis
The artifact is a complete C program that actively triggers CVE-2026-23231, performs heap manipulation, and attempts to gain root privileges. It includes all steps to exploit the vulnerability: triggering the UAF, reclaiming memory, leaking addresses, and escalating privileges. The code's primary purpose is exploitation, not mere detection or analysis.
exploits/linux/local/52549.py:1exploits/linux/local/52549.py:1020-1102exploits/linux/local/52549.py:1204-1296Requirements
- Local, unprivileged user access to a vulnerable Linux kernel (3.16 – 6.19.3).
exploits/linux/local/52549.py:6 - Ability to create user and network namespaces (unshare with CLONE_NEWUSER | CLONE_NEWNET).
exploits/linux/local/52549.py:646 - CAP_NET_ADMIN capability within the created namespace to configure nftables.
exploits/linux/local/52549.py:644
Observed behavior
- Checks the running kernel version against a list of vulnerable ranges and exits if patched.
exploits/linux/local/52549.py:237-286 - Creates a new user and network namespace to obtain CAP_NET_ADMIN.
exploits/linux/local/52549.py:640-676 - Sets up nftables infrastructure by creating a table and multiple base chains to prepare the kernel heap.
exploits/linux/local/52549.py:974-1018 - Triggers the use-after-free by applying memory pressure and attempting to create a new base chain, causing a hook registration failure that frees the chain without an RCU grace period.
exploits/linux/local/52549.py:1020-1102 - Sprays the freed kmalloc-256 slot with crafted msg_msg objects to control the contents of the freed nft_base_chain memory.
exploits/linux/local/52549.py:1104-1159 - Starts a concurrent chain dump thread to race against the UAF, attempting to read stale or sprayed data to leak a kernel heap address.
exploits/linux/local/52549.py:1161-1202 - Sets up a modprobe helper payload (payload withheld) and an invalid binary (payload withheld) to attempt privilege escalation via payload withheld.
exploits/linux/local/52549.py:787-809 - Attempts to trigger the modprobe call by executing the invalid binary, which would execute the helper script as root if modprobe_path was successfully overwritten.
exploits/linux/local/52549.py:811-829
Behaviors behind the backdoor verdict
Observables
- File Creation
- Payload withheldCreates a helper script used in the payload withheld technique for privilege escalation. This is a standard part of the exploit, not a backdoor.
exploits/linux/local/52549.py:792-798 - File Creation
- Payload withheldCreates an invalid ELF binary to trigger the kernel's call_usermodehelper, which invokes the overwritten modprobe_path. Standard exploit technique.
exploits/linux/local/52549.py:801-806 - File Creation
- Payload withheldThe modprobe helper script copies /bin/sh to payload withheld and sets the suid bit. This is the intended privilege escalation payload, not a backdoor.
exploits/linux/local/52549.py:794-796 - Privilege Escalation
- Payload withheldThe exploit attempts to overwrite the kernel's modprobe_path variable to execute a user-controlled script as root. This is the documented goal of the PoC.
exploits/linux/local/52549.py:1210-1230
What the analysis did not establish
- The file extension is .py but the content is C source code, not Python.
- The exploit's privilege escalation step is incomplete; it acknowledges that a reliable KASLR bypass is not implemented and the payload withheld is not guaranteed to succeed.
- The analysis is based solely on static code review; the code was not executed, and its actual behavior or reliability cannot be confirmed.
- Only the single text file (52549.py) was reviewed; no external dependencies or binary files were included in the evidence.
- The review does not assess the safety or reliability of the exploit code when executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBLinux Kernel proc_readdir_de() 6.18-rc5 - Local Privilege Escalation
ExploitDB exploitPublished 2026-05-04ExploitCVE-2025-402711 file
Analysis
Technical assessment
This is a local privilege escalation exploit for CVE-2025-40271, a use-after-free vulnerability in the Linux kernel's proc_readdir_de() function. The code creates a user/network namespace, sets up veth pairs to populate /proc entries, and races getdents64() calls against veth deletion to trigger the UAF. It uses msg_msg heap spraying to reclaim freed memory and leaks a kernel heap pointer via anomalous d_ino values. The exploit then attempts to achieve root by overwriting modprobe_path, though the full chain requires target-specific offsets.
Backdoor review
No backdoor observed in reviewed code
The supplied PoC is a standard local privilege escalation exploit for CVE-2025-40271. It uses documented techniques (namespace creation, veth pair manipulation, msg_msg heap spray, race condition triggering, and modprobe_path overwrite) to gain root. No concealed executable behavior, unrelated payload, credential theft, persistence, or operator-directed harm was observed. The code is fully readable and its actions align with the stated exploit goal.
Classification basis and observed behavior
Classification basis
The code actively exercises the vulnerability by racing getdents64() against veth deletion to trigger a use-after-free, sprays heap memory to reclaim the freed object, leaks a kernel pointer, and attempts to escalate privileges via modprobe_path overwrite. This constitutes an exploit, not merely a scanner or writeup.
exploits/linux/local/52550.c:1exploits/linux/local/52550.c:37-43exploits/linux/local/52550.c:603-661exploits/linux/local/52550.c:663-700Requirements
- Vulnerable Linux kernel version (3.14+ through 6.18-rc5, unpatched)
exploits/linux/local/52550.c:6 - User namespace support enabled (unprivileged_userns_clone)
exploits/linux/local/52550.c:237-238 - Ability to create veth pairs (requires CAP_NET_ADMIN in namespace)
exploits/linux/local/52550.c:38 - System V message queue support for heap spray
exploits/linux/local/52550.c:409
Observed behavior
- Checks kernel version to determine if vulnerable
exploits/linux/local/52550.c:187-230 - Creates user and network namespace via unshare()
exploits/linux/local/52550.c:234-262 - Creates veth pairs using netlink RTM_NEWLINK messages to populate /proc/self/net/dev_snmp6/
exploits/linux/local/52550.c:283-362 - Spawns a thread that continuously calls getdents64() on /proc/self/net/dev_snmp6/ to detect anomalous d_ino values
exploits/linux/local/52550.c:480-520 - Races veth deletion (RTM_DELLINK) with the getdents64() thread to trigger use-after-free
exploits/linux/local/52550.c:603-661 - Sprays msg_msg objects via msgsnd() to reclaim freed proc_dir_entry slab memory
exploits/linux/local/52550.c:415-434 - Detects UAF by checking if d_ino looks like a kernel heap pointer (0xffff...)
exploits/linux/local/52550.c:508-514 - Attempts privilege escalation via modprobe_path overwrite technique (sets up /tmp/pwn and /tmp/trigger, then executes trigger)
exploits/linux/local/52550.c:524-552
Behaviors behind the backdoor verdict
Observables
- Exploit Technique
- Payload withheldThe exploit writes a shell script to /tmp/pwn and a trigger file to /tmp/trigger, then attempts to overwrite modprobe_path to execute /tmp/pwn as root. This is a well-known LPE technique.
exploits/linux/local/52550.c:524-552 - File Creation
- Payload withheldThe exploit creates temporary files in /tmp as part of the modprobe_path overwrite technique. These are standard for this type of exploit and are cleaned up in step_cleanup().
exploits/linux/local/52550.c:526-537exploits/linux/local/52550.c:708-709 - Privilege Escalation Goal
- Payload withheldThe ultimate goal is to spawn a root shell using a setuid copy of /bin/sh. This is the expected behavior of a local privilege escalation exploit.
exploits/linux/local/52550.c:528exploits/linux/local/52550.c:750-753
What the analysis did not establish
- The modprobe_path overwrite step is incomplete; the code acknowledges it requires target-specific KASLR offsets and only demonstrates the UAF and heap leak.
- The exploit is described as having ~40-60% UAF hit rate and ~10% kernel panic risk, indicating it is not fully reliable.
- Only the single C source file was analyzed; no external dependencies or build artifacts were inspected.
- Only the single C source file (52550.c) was reviewed; no external libraries or build artifacts were inspected.
- The review does not verify that the exploit actually works or is safe to run; it only assesses the presence of backdoor or deceptive behavior in the provided text.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.