bluedragonsecurity/CVE-2026-46215-EXPLOIT

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Linux kernel local privilege escalation exploit for CVE-2026-46215, a use-after-free vulnerability in the DRM subsystem. It races the DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE ioctls to create a dangling GEM handle, then uses heap manipulation and pipe spraying to overwrite /etc/passwd with a root entry and spawn a root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Makefile, and a C exploit for CVE-2026-46215. The exploit performs a local privilege escalation (LPE) by racing a DRM ioctl to achieve a use-after-free, then overwriting /etc/passwd to add a root user and spawning a root shell via su. All observed behavior is consistent with the stated LPE goal; no concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload was found.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesCMakefile
Target softwareLinux kernelDRM subsystem
Attack typesuse-after-freerace conditionlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete C source code that actively exploits CVE-2026-46215 to achieve local privilege escalation by overwriting /etc/passwd and spawning a root shell. It does not merely detect or report the vulnerability; it exercises the use-after-free to corrupt memory and escalate privileges.

exploit.c:1-613README.md:1-10

Requirements

  • User must be in the 'video' group to open /dev/dri.README.md:74-89
  • The system must have a virtio DRM device available.exploit.c:149-175
  • The target kernel must be Linux 7.0 (vulnerability exists from 7.0 to 7.0.8).README.md:30-32exploit.c:14-16

Observed behavior

  • Opens a virtio DRM device from /dev/dri.exploit.c:149-175
  • Creates a GEM buffer object and races DRM_IOCTL_GEM_CHANGE_HANDLE with DRM_IOCTL_GEM_CLOSE to produce a dangling handle.exploit.c:215-247
  • Performs heap grooming (defrag, migration, pipe spray) to reclaim the freed GEM object's slab page with pipe buffers.exploit.c:443-545
  • Uses the dangling handle with DRM_IOCTL_VIRTGPU_RESOURCE_INFO to leak a kernel pointer for KASLR bypass.exploit.c:547-558
  • Writes a crafted 'oot::0:0:dirty:/root:/bin/sh' payload into the pipe buffers to overwrite /etc/passwd.exploit.c:338exploit.c:562-565
  • Spawns a root shell via 'su - root' after successfully overwriting /etc/passwd.exploit.c:285-335exploit.c:572-583
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload
oot::0:0:dirty:/root:/bin/sh\nThe exploit writes this string into /etc/passwd via pipe spray to create a root-equivalent user 'dirty' with UID 0, which is the standard LPE technique for this class of exploit.exploit.c:338exploit.c:564
Privilege Escalation
spawning root shell via suAfter overwriting /etc/passwd, the exploit calls root("root") which forkpty's and exec's /bin/su to provide an interactive root shell. This is the intended outcome of the LPE.exploit.c:285-335exploit.c:583
Target File
/etc/passwdThe exploit targets /etc/passwd for overwrite, a common LPE target. It also creates a dummy /etc/passwd if missing, which is part of the exploit setup.exploit.c:92exploit.c:401-412
Review boundaries

What the analysis did not establish

  • Three non-text media files (lpe.png, lpe2.png, process.png) totaling 419864 bytes are present but not analyzed; they are screenshots referenced in the README and do not affect classification of the primary C source code.
  • The exploit is explicitly described by its author as unstable, unreliable, and may cause kernel panics, but this does not change its classification as an exploit.
  • Three non-text media files (lpe.png, lpe2.png, process.png) totaling 419864 bytes were present in the repository but were not analyzed; they are flagged as metadata-only. The review covers only the supplied text files.
  • The review does not assess whether the exploit is functional, safe, or reliable; it only evaluates the presence of backdoor or deceptive behavior in the provided source code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1