CVE-2026-23231 Exploit Metadata

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

A C exploit targeting CVE-2026-23231, a use-after-free vulnerability in the Linux kernel's nf_tables subsystem. The code triggers the vulnerability by causing a hook registration failure, reclaims the freed memory with a heap spray, attempts to leak kernel addresses via a race condition, and ultimately aims to overwrite modprobe_path for local privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a C source file implementing a local privilege escalation exploit for CVE-2026-23231. It uses documented kernel exploitation techniques (UAF, heap spray, modprobe_path overwrite) to gain root. No concealed backdoor, deceptive payload, or unrelated harmful behavior was observed. The code is self-contained, well-commented, and its actions are consistent with the stated exploit goal.

ClassificationExploit

Model confidence95%

AuthenticationNot required

LanguagesC

Target softwareLinux kernel

Attack typesuse-after-freelocal privilege escalation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete C program that actively triggers CVE-2026-23231, performs heap manipulation, and attempts to gain root privileges. It includes all steps to exploit the vulnerability: triggering the UAF, reclaiming memory, leaking addresses, and escalating privileges. The code's primary purpose is exploitation, not mere detection or analysis.

exploits/linux/local/52549.py:1exploits/linux/local/52549.py:1020-1102exploits/linux/local/52549.py:1204-1296

Requirements

Local, unprivileged user access to a vulnerable Linux kernel (3.16 – 6.19.3).exploits/linux/local/52549.py:6
Ability to create user and network namespaces (unshare with CLONE_NEWUSER | CLONE_NEWNET).exploits/linux/local/52549.py:646
CAP_NET_ADMIN capability within the created namespace to configure nftables.exploits/linux/local/52549.py:644

Observed behavior

Checks the running kernel version against a list of vulnerable ranges and exits if patched.exploits/linux/local/52549.py:237-286
Creates a new user and network namespace to obtain CAP_NET_ADMIN.exploits/linux/local/52549.py:640-676
Sets up nftables infrastructure by creating a table and multiple base chains to prepare the kernel heap.exploits/linux/local/52549.py:974-1018
Triggers the use-after-free by applying memory pressure and attempting to create a new base chain, causing a hook registration failure that frees the chain without an RCU grace period.exploits/linux/local/52549.py:1020-1102
Sprays the freed kmalloc-256 slot with crafted msg_msg objects to control the contents of the freed nft_base_chain memory.exploits/linux/local/52549.py:1104-1159
Starts a concurrent chain dump thread to race against the UAF, attempting to read stale or sprayed data to leak a kernel heap address.exploits/linux/local/52549.py:1161-1202
Sets up a modprobe helper payload (/tmp/pwn) and an invalid binary (/tmp/trigger) to attempt privilege escalation via modprobe_path overwrite.exploits/linux/local/52549.py:787-809
Attempts to trigger the modprobe call by executing the invalid binary, which would execute the helper script as root if modprobe_path was successfully overwritten.exploits/linux/local/52549.py:811-829

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Creation: /tmp/pwnCreates a helper script used in the modprobe_path overwrite technique for privilege escalation. This is a standard part of the exploit, not a backdoor.exploits/linux/local/52549.py:792-798
File Creation: /tmp/triggerCreates an invalid ELF binary to trigger the kernel's call_usermodehelper, which invokes the overwritten modprobe_path. Standard exploit technique.exploits/linux/local/52549.py:801-806
File Creation: /tmp/rootshThe modprobe helper script copies /bin/sh to /tmp/rootsh and sets the suid bit. This is the intended privilege escalation payload, not a backdoor.exploits/linux/local/52549.py:794-796
Privilege Escalation: modprobe_path overwriteThe exploit attempts to overwrite the kernel's modprobe_path variable to execute a user-controlled script as root. This is the documented goal of the PoC.exploits/linux/local/52549.py:1210-1230

Review boundaries

What the analysis did not establish

The file extension is .py but the content is C source code, not Python.
The exploit's privilege escalation step is incomplete; it acknowledges that a reliable KASLR bypass is not implemented and the modprobe_path overwrite is not guaranteed to succeed.
The analysis is based solely on static code review; the code was not executed, and its actual behavior or reliability cannot be confirmed.
Only the single text file (52549.py) was reviewed; no external dependencies or binary files were included in the evidence.
The review does not assess the safety or reliability of the exploit code when executed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-23231