totekuh/CVE-2026-36355

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a complete, portable local privilege escalation exploit (kpwn.c) for CVE-2026-36355. It uses the vulnerable write_mem/read_mem ioctls in the Realtek rtl819x driver to read and write arbitrary kernel memory, auto-detects task_struct offsets, and overwrites process credentials to gain root from an unprivileged user.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md describing CVE-2026-36355 and a reference exploit (kpwn.c) that demonstrates local privilege escalation by abusing missing access-control checks on debug ioctls in the Realtek rtl819x Jungle SDK Wi-Fi driver. The exploit code performs only the actions necessary to achieve privilege escalation: finding a vulnerable interface, reading/writing kernel memory to locate and overwrite the calling process's credentials, and spawning a root shell. No concealed executable behavior, unrelated payload delivery, persistence mechanisms, or operator-directed harm were observed. The code is straightforward C with no obfuscation or hidden functionality.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesC
Target softwareRealtek rtl819x Jungle SDK Wi-Fi kernel driver (rtl8192cd, rtl8192es, etc.)
Attack typeslocal privilege escalationarbitrary kernel memory read/write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is kpwn.c, a complete C program that actively exploits CVE-2026-36355 to achieve local privilege escalation. It uses the vulnerable ioctls to read and write kernel memory, locates and modifies its own process credentials, and executes a root shell. This is code intended to exercise a vulnerability, not merely detect or document it.

kpwn.c:1-14kpwn.c:330-423

Requirements

  • Local unprivileged user access to a device with a vulnerable Realtek rtl819x Wi-Fi driver loaded and a wireless interface available.kpwn.c:16
  • Ability to open a socket and perform ioctl calls on the wireless interface (may require membership in the 'inet' group on some kernels).kpwn.c:341-347

Observed behavior

  • Scans /sys/class/net to find a wireless interface that responds to the read_mem ioctl (0x89F6) with valid data.kpwn.c:100-119
  • Brute-force scans kernel .data memory region to locate the init_task structure by searching for the 'swapper' string and validating the associated credential structure.kpwn.c:123-178
  • Auto-detects task_struct field offsets (comm, cred, tasks, pid) by analyzing the memory layout of init_task.kpwn.c:189-278
  • Walks the kernel task list to find the task_struct of the current process.kpwn.c:282-326
  • Uses the write_mem ioctl (0x89F5) to overwrite the process's kernel credentials (UID, GID, capability sets) with root-equivalent values.kpwn.c:406-409
  • Spawns a root shell via execl('/bin/sh', 'sh', NULL) after successful credential overwrite.kpwn.c:420
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Local privilege escalation via kernel memory read/write using ioctl 0x89F5/0x89F6The exploit leverages the documented vulnerability to overwrite process credentials and gain root. This is the expected and stated purpose of the PoC.kpwn.c:406-410kpwn.c:420
Ioctl Usage
IOCTL_WRITE (0x89F5) and IOCTL_READ (0x89F6)These ioctl codes correspond to the vulnerable write_mem and read_mem handlers described in the CVE. The exploit uses them exclusively for kernel memory access.kpwn.c:36-37kpwn.c:49-96
Credential Overwrite
Zeroing uid..fsgid and setting all capability bits to 0xFFFFFFFFThis is the standard technique for privilege escalation via credential structure overwrite. It targets only the calling process's own credentials.kpwn.c:408-409
Review boundaries

What the analysis did not establish

  • The evidence packet includes only the README.md and kpwn.c files. Two other text files and one non-text file (likely the screenshot kpwn-demo.png) are present in the repository but their content is not provided.
  • The analysis is based solely on static review of the provided source code; the exploit was not executed or tested.
  • Three additional files in the repository (totaling 5 files) were not included as text in the evidence packet. Their content is unknown, but the packet metadata indicates they are non-text or were omitted by the selection rule. The review is limited to the provided README.md and kpwn.c.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1