0xBlackash/CVE-2026-46331

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a local privilege escalation exploit for CVE-2026-46331. It uses a calibration step to determine the offset delta for a pedit-based write primitive, then corrupts the page cache of a setuid-root 'su' binary by overwriting its entry point with shellcode. Executing the corrupted 'su' binary yields a root shell.

Backdoor review

No backdoor observed in reviewed code

The PoC source code (CVE-2026-46331.c) implements a local privilege escalation exploit for the described CVE using netlink-based traffic control (tc) pedit actions to corrupt the page cache and overwrite a setuid-root su binary entry point with shellcode. The README.md is a documentation file describing the vulnerability. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The code performs only the advertised exploit behavior: it sets up a netlink socket, configures a clsact qdisc with a pedit action, sends data to trigger the partial COW bug, calibrates the write offset, and then uses the corruption primitive to overwrite /bin/su (or similar) with shellcode to gain a root shell. All operations are local and consistent with the stated CVE exploitation goal.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesc
Target softwarelinux_kernelsu
Attack typeslocal_privilege_escalationmemory_corruption
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The C code implements a full local privilege escalation chain: it calibrates a write primitive, corrupts a setuid binary's executable code in the page cache, and then executes the corrupted binary to gain root. This is active exploitation, not mere detection or scanning.

CVE-2026-46331.c:1-9CVE-2026-46331.c:501-511CVE-2026-46331.c:636-639

Requirements

  • Local unprivileged code executionCVE-2026-46331.c:645-648
  • Ability to create user and network namespaces (unshare)CVE-2026-46331.c:559
  • CAP_NET_ADMIN in the new namespace to configure tc pedit rulesCVE-2026-46331.c:559
  • A setuid-root 'su' binary present on the systemCVE-2026-46331.c:513-524

Observed behavior

  • Creates a new user and network namespace via unshareCVE-2026-46331.c:559
  • Configures uid/gid mappings for the new namespaceCVE-2026-46331.c:563-567
  • Calibrates the pedit write offset by sending a marked packet through a loopback tc pedit rule and reading back the file to find the markCVE-2026-46331.c:395-441
  • Opens a setuid-root 'su' binary and locates its executable entry point offsetCVE-2026-46331.c:526-543
  • Uses the pedit primitive to overwrite the 'su' entry point with shellcode that executes /bin/shCVE-2026-46331.c:474-499CVE-2026-46331.c:553-580
  • Executes the corrupted 'su' binary to spawn a root shellCVE-2026-46331.c:636-639
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Shellcode
0x31, 0xff, 0xb8, 0x6a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xb8, 0x69, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x31, 0xd2, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00, 0x53, 0x48, 0x89, 0xe7, 0x52, 0x57, 0x48, 0x89, 0xe6, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0x0f, 0x05x86-64 shellcode that calls setuid(0) and then execve('/bin/sh', NULL, NULL). This is the payload written over the su entry point to gain a root shell, consistent with the stated LPE goal.CVE-2026-46331.c:505-511
Target Binary
/bin/su, /usr/bin/su, /sbin/su, /usr/sbin/suThe exploit searches for a setuid-root su binary and overwrites its entry point with shellcode. This is the standard LPE technique for this class of kernel memory corruption.CVE-2026-46331.c:513-524
Exploit Primitive
netlink RTM_NEWTFILTER with pedit action to trigger partial COW page cache corruptionThe core exploit mechanism uses netlink to install a tc filter with a pedit action that writes controlled data at a calibrated offset, corrupting the page cache backing the su binary.CVE-2026-46331.c:311-338CVE-2026-46331.c:395-441CVE-2026-46331.c:474-499
Review boundaries

What the analysis did not establish

  • Evidence is limited to the two text files in the repository snapshot; no binary artifacts, build scripts, or runtime logs are included.
  • The exploit's reliability depends on kernel version, system configuration, and the presence of a setuid-root su binary, which cannot be verified from the provided evidence alone.
  • Only the two text files (CVE-2026-46331.c and README.md) were reviewed; no binary files were present or analyzed.
  • The review is static and based solely on the provided source code; no runtime behavior was observed.
  • The code includes a shellcode payload that is executed in the context of the exploited su binary; this is part of the advertised exploit and not a hidden backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1