0xCyberstan/CVE-2026-53360-POC

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A guest kernel module (trigger.c) that exploits CVE-2026-53360, a heap out-of-bounds vulnerability in the Linux kernel's KVM SEV-SNP Page State Change (PSC) handler. The module crafts malicious VMGEXIT requests to cause the host to read and write beyond an allocated buffer, leaking host heap layout and corrupting adjacent slab objects.

Backdoor review

No backdoor observed in reviewed code

The artifact is a proof-of-concept (PoC) for CVE-2026-53360, a Linux kernel vulnerability in KVM's SEV-SNP PSC handling. It consists of a README, a Makefile, and a guest kernel module (trigger.c). The code performs only the described vulnerability demonstration: it crafts malformed PSC requests to trigger out-of-bounds reads and writes on the host kernel heap. No backdoor, trojan, or deceptive behavior was observed. The module checks for an SEV-SNP environment, runs four stages of probing/writing/scanning/spraying, and unloads itself. There is no persistence, credential theft, unrelated remote access, or concealed payload.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesC
Target softwareLinux kernelKVMSEV-SNP
Attack typesheap out-of-bounds readheap out-of-bounds writeinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, compilable kernel module (trigger.c) that actively exploits the vulnerability by sending crafted VMGEXIT requests to the host hypervisor, causing out-of-bounds reads and writes. The README explicitly describes it as a 'Proof of concept' that 'corrupts host kernel heap memory' and 'leaks host heap layout information', and the code implements the described exploitation stages.

README.md:3-7trigger.c:1-13trigger.c:344-427

Requirements

  • The attacker must control a guest VM running on an AMD SEV-SNP enabled host.README.md:30-31
  • The host kernel must be vulnerable (versions 6.10 through 7.1-rc5, before the fix).README.md:15-16
  • The attacker must be able to load a kernel module (trigger.ko) inside the guest VM.README.md:210-215

Observed behavior

  • The module crafts a PSC request with a small allocation size (24 bytes) and a large end_entry value, causing the host to read and write past the allocated buffer into adjacent kernel heap objects.trigger.c:112-139trigger.c:67-69
  • Stage 1 probes out-of-bounds entries to map the host heap (zero vs. non-zero memory).trigger.c:169-210
  • Stage 2 demonstrates a persistent out-of-bounds write by writing a value into an adjacent slab object and confirming it is skipped on a subsequent request.trigger.c:218-276
  • Stage 3 performs a single scan with end_entry=200 to measure the reach of the out-of-bounds access.trigger.c:282-302
  • Stage 4 fires 200 VMGEXITs with out-of-bounds entries to repeatedly trigger the vulnerability and generate KASAN reports on the host.trigger.c:310-342
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
trigger.c performs out-of-bounds PSC requests to demonstrate CVE-2026-53360The code matches the described PoC behavior: it allocates a 24-byte scratch buffer, sets end_entry beyond the buffer size, and issues VMGEXITs to cause host kernel slab out-of-bounds access.trigger.c:67-70trigger.c:112-139trigger.c:169-210trigger.c:218-276trigger.c:282-302trigger.c:310-342
Environment Check
trigger.c verifies SEV-SNP guest environment via CPUID before proceedingThe module refuses to run outside an SEV-SNP guest, limiting its effect to the intended vulnerable host configuration.trigger.c:355-364
Self Termination
trigger.c init function returns -EAGAIN, causing the module to unload immediately after executionThe module does not persist in the kernel; it runs its stages and exits, leaving no resident code.trigger.c:425-426
Review boundaries

What the analysis did not establish

  • The evidence includes a complete README and trigger.c source code, but one file (LICENSE) is omitted from the text content, though its metadata is present. This does not affect classification.
  • The analysis is based solely on the provided source code and documentation; the code was not executed, and its effectiveness is not verified.
  • One file (LICENSE) was classified as binary and not analyzed for text content; it is a standard GPL-2.0 license file per the README and is unlikely to contain executable code.
  • The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1