gagaltotal/CVE-2026-43499-PoC-Scanner

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Go program that implements both a kernel version scanner and a proof-of-concept exploit for CVE-2026-43499. The exploit code uses futex syscalls to trigger a use-after-free in the Linux kernel's rtmutex subsystem, which is expected to cause a kernel panic.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Go source file and a README. The Go code implements a kernel version scanner and a proof-of-concept trigger for CVE-2026-43499 using futex syscalls. No concealed executable behavior, unrelated remote access, persistence, credential theft, or operator-directed harm is present. The code's behavior is consistent with its stated purpose of demonstrating the vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesGo
Target softwareLinux kernel
Attack typesuse-after-freedenial-of-service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, compilable Go program with a dedicated 'runExploit' function that actively triggers the vulnerability using futex syscalls, which is the definition of an exploit. The scanner functionality is secondary.

CVE-2026-43499_poc_scan.go:288-347CVE-2026-43499_poc_scan.go:371-388

Requirements

  • Root or sudo privileges are required to run the exploit mode.README.md:20
  • The system must be running a vulnerable Linux kernel version.CVE-2026-43499_poc_scan.go:245-256

Observed behavior

  • The scanner mode checks the kernel release and configuration to determine if the system is vulnerable.CVE-2026-43499_poc_scan.go:258-281
  • The exploit mode uses multiple threads and futex operations (FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI) to create a deadlock chain and trigger a use-after-free condition.CVE-2026-43499_poc_scan.go:138-193CVE-2026-43499_poc_scan.go:288-347
  • The exploit is expected to cause a kernel panic and system crash.CVE-2026-43499_poc_scan.go:289-290
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Scanner
Kernel version and config check for CVE-2026-43499The scanner reads /proc/version and /boot/config-* to determine vulnerability, which is expected for a PoC scanner.CVE-2026-43499_poc_scan.go:200-281
Exploit Trigger
Futex-based UAF trigger using FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PIThe exploit code constructs a specific futex interaction to trigger the described kernel bug. It warns the user and requires explicit confirmation before running.CVE-2026-43499_poc_scan.go:288-347
User Confirmation
Requires typing 'YES' before running the exploitThe exploit path includes a prompt that requires the user to type 'YES' to proceed, indicating no hidden or automatic execution.CVE-2026-43499_poc_scan.go:291-300
Review boundaries

What the analysis did not establish

  • The evidence includes a non-text media file (screenshot) that was not analyzed.
  • The artifact's completeness cannot be fully verified as one text file was omitted from the packet.
  • Two files (one non-text media file and one text file without content) were omitted from the evidence packet and were not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
  • The review is limited to the supplied text evidence and does not verify the correctness or safety of the PoC when executed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1