CVE-2026-46300 Exploit Metadata

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Go exploit for CVE-2026-46300 that patches the page-cache of /usr/bin/su by triggering in-place AES-GCM decryption over shared page-cache fragments, then executes the patched binary to gain a root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied Go source code implements a local privilege escalation (LPE) exploit for CVE-2026-46300. It uses TCP_ULP espintcp and splice to trigger in-place AES-GCM decryption into the page cache of /usr/bin/su, overwriting it with a root-shell payload. The code performs only the described exploit behavior: patching a system binary to gain root, then executing a shell. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the PoC runner was observed.

ClassificationExploit

Model confidence95%

AuthenticationRequired

LanguagesGo

Target softwareLinux kernel

Attack typesLocal Privilege EscalationMemory Corruption

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2026-46300 to achieve local privilege escalation. It implements a byte-by-byte write primitive to overwrite /usr/bin/su in the page cache with attacker-controlled shellcode, then executes the modified binary to gain root. This is a full exploit, not merely a scanner or writeup.

Koshmare-Blossom-Fragnesia-go-64640f0/main.go:3-14Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:110-151Koshmare-Blossom-Fragnesia-go-64640f0/main.go:55-65

Requirements

Local unprivileged user access to a vulnerable Linux kernel (3.9 through 7.1-rc4) with CONFIG_ESPINTCP enabled.Koshmare-Blossom-Fragnesia-go-64640f0/main.go:1-100
Ability to create user and network namespaces (CLONE_NEWUSER, CLONE_NEWNET).Koshmare-Blossom-Fragnesia-go-64640f0/main.go:84-85
Target file /usr/bin/su must exist and be readable.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:31

Observed behavior

Spawns a child process in new user and network namespaces to isolate the exploit.Koshmare-Blossom-Fragnesia-go-64640f0/main.go:80-98
Builds a 256-entry AES-GCM keystream table to map desired XOR values to IV nonces.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:75-97
Iterates over a 192-byte shellcode payload, reading each byte of /usr/bin/su and computing the required keystream byte to XOR the current byte into the desired shellcode byte.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:112-138
For each byte, establishes a TCP connection to localhost, splices a page of /usr/bin/su into the receive queue, then sets TCP_ULP to espintcp, causing the kernel to decrypt the queued data in-place over the page-cache page.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:156-275
After patching, verifies the entry point bytes of /usr/bin/su match the shellcode.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:143-148
If patching succeeds, executes /usr/bin/su via a PTY to obtain a root shell.Koshmare-Blossom-Fragnesia-go-64640f0/main.go:60-64

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Overwrites /usr/bin/su page cache with a root-shell ELF payload via CVE-2026-46300 primitiveThe code's stated purpose is to demonstrate the CVE-2026-46300 vulnerability. It reads /usr/bin/su, XORs bytes using a keystream derived from AES-GCM, and writes a 192-byte shellcode that executes /bin/sh. This is consistent with the described exploit chain and does not constitute a backdoor.Koshmare-Blossom-Fragnesia-go-64640f0/main.go:3-14Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:110-151
Payload: 192-byte x86_64 ELF shellcode that executes /bin/shThe payload is embedded in the exploit and is written to /usr/bin/su. It is the intended exploit payload, not a hidden backdoor.Koshmare-Blossom-Fragnesia-go-64640f0/trigger.go:43-56
Privilege Escalation: Uses CLONE_NEWUSER and CLONE_NEWNET to create a namespace-isolated child process for the exploitThis is a standard technique for LPE exploits requiring network namespace isolation. It is part of the documented exploit chain.Koshmare-Blossom-Fragnesia-go-64640f0/main.go:74-99

Review boundaries

What the analysis did not establish

Evidence includes only two Go source files; 5 additional files are present in the artifact but were not provided as text and are flagged as unclassified binary or non-text content.
The analysis is based solely on static review of the provided source code; the code was not executed, and its reliability or effectiveness is not verified.
The exploit relies on specific kernel configurations (CONFIG_ESPINTCP) and timing assumptions that may not hold in all environments.
Only the two Go source files (main.go, trigger.go) were provided and reviewed. The artifact metadata indicates 5 additional unclassified files totaling 10,748 bytes were present in the repository unit but were not included in the evidence packet. Their content is unknown and could contain additional behavior not assessed here.
The review is based solely on static analysis of the provided text; the code was not executed, and dynamic behavior cannot be confirmed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-46300