bluedragonsecurity/CVE-2026-31429-POC

GitHubRepository PoCScannerC

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a scanner that triggers and detects CVE-2026-31429, a Linux kernel slab cross-cache free vulnerability. It loads a minimal BPF program and calls BPF_PROG_TEST_RUN with crafted data to trigger the bug, then instructs the user to check dmesg for a specific kernel warning (warn_free_bad_obj) to confirm vulnerability. It does not exploit the corruption for privilege escalation or other impact.

Backdoor review

No backdoor observed in reviewed code

The repository contains a documented proof-of-concept for CVE-2026-31429. The README describes the vulnerability, root cause, and reproduction steps. The C source file implements a minimal BPF program loader and test-run trigger to reproduce the kernel slab cross-cache free bug. No concealed executable behavior, persistence, credential theft, unrelated remote access, or deceptive payloads were observed. The code performs only the described PoC actions: loading a trivial BPF program and invoking BPF_PROG_TEST_RUN with crafted data to trigger the kernel warning.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagescmarkdown
Target softwarelinux_kernel
Attack typesdenial_of_service
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The C code triggers the vulnerability and relies on the kernel's own SLUB debugging (warn_free_bad_obj) to report the cross-cache free. It does not contain any code to exploit the resulting slab corruption for privilege escalation, information disclosure, or other impacts. The README explicitly states it is 'not a working exploit, just a POC' and the code only prints a message to check dmesg, which is characteristic of a scanner that validates vulnerability presence.

README.md:23cve-2026-31429-poc-only.c:108

Requirements

  • Root privileges (uid=0) to load BPF programs.README.md:170
  • Kernel compiled with CONFIG_KFENCE=y, CONFIG_BPF_SYSCALL=y, CONFIG_NET_SCH_INGRESS=y, CONFIG_SLUB_DEBUG=y, CONFIG_STACKDEPOT=y.README.md:163-168

Observed behavior

  • Loads a minimal 3-instruction BPF program of type BPF_PROG_TYPE_SCHED_CLS.cve-2026-31429-poc-only.c:28-32cve-2026-31429-poc-only.c:55-64
  • Calls BPF_PROG_TEST_RUN syscall with 284 bytes of crafted packet data, repeat=4, and BPF_F_TEST_RUN_ON_CPU flag to trigger the cross-cache free.cve-2026-31429-poc-only.c:66-78cve-2026-31429-poc-only.c:100-101
  • Loops 50 additional BPF_PROG_TEST_RUN calls for reliability.cve-2026-31429-poc-only.c:105-106
  • Instructs user to check dmesg for 'warn_free' to confirm vulnerability detection.cve-2026-31429-poc-only.c:108
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Bpf Program
ld_imm64 r0, 0; exitMinimal 3-instruction BPF program used to trigger the kernel bug via BPF_PROG_TEST_RUN.cve-2026-31429-poc-only.c:28-32
Syscall
bpf(BPF_PROG_LOAD, ...) and bpf(BPF_PROG_TEST_RUN, ...)The PoC uses standard Linux BPF syscalls to load and run a BPF program, which is the documented trigger mechanism for the vulnerability.cve-2026-31429-poc-only.c:55-78
Mmap Setup
mmap calls at fixed addresses (0x1ffffffff000, 0x200000000000, 0x200001000000)These mmap calls set up memory mappings similar to Syzkaller's environment, which is a common practice in kernel fuzzing PoCs to ensure reliable reproduction of the bug.cve-2026-31429-poc-only.c:86-91
Review boundaries

What the analysis did not establish

  • The artifact includes a non-text file (dmesg.txt) that was not provided in the evidence, so its content cannot be analyzed.
  • The evidence does not include the binary output of compilation or runtime behavior; analysis is based solely on static source code review.
  • One text file (dmesg.txt) was not provided as readable text; it is described as raw kernel splat output and is consistent with the PoC's documented behavior.
  • One non-text media file (likely a screenshot or image) was flagged as metadata-only and not analyzed; its size (397200 bytes) suggests it is not executable code.
  • The review is limited to the supplied evidence packets and does not verify the behavior of the compiled binary at runtime.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1