HackSpeak/CVE-2026-64531

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (ovswrap-poc.py) that exploits CVE-2026-64531 in the Linux kernel's Open vSwitch module to achieve local privilege escalation from an unprivileged user to root. It constructs oversized nested action attributes to trigger a 16-bit nla_len integer wrap, gaining arbitrary kernel read and decrement primitives. It then locates a host process's credentials, modifies them to gain full capabilities, and writes a sudoers entry to obtain a root shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PoC script for CVE-2026-64531, a Linux kernel Open vSwitch local privilege escalation. The script uses netlink sockets to trigger a kernel vulnerability, gain arbitrary read/write primitives, modify kernel credentials, and write a sudoers entry to obtain a root shell. All observed behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or deceptive operator-directed harm was found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarelinux_kernelopenvswitch
Attack typeslocal_privilege_escalationmemory_corruption
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, self-contained Python script (ovswrap-poc.py) that actively exploits CVE-2026-64531 to achieve local privilege escalation. It constructs malicious OVS flow actions, corrupts kernel memory, and modifies process credentials to gain root access, which is the definition of an exploit.

README.md:3ovswrap-poc.py:1-2154

Requirements

  • Unprivileged user with ability to create user and network namespaces (unshare -Urn).README.md:14README.md:33
  • Affected Linux kernel with OVS conntrack support and FTP conntrack helper loaded.README.md:32
  • Python 3.7+ and sudo installed.README.md:34

Observed behavior

  • Enters a private user and network namespace via unshare -Urn.ovswrap-poc.py:658-682
  • Creates an OVS datapath and installs a flow with an oversized CLONE action containing many CT actions to trigger the nla_len wrap.ovswrap-poc.py:1104-1115ovswrap-poc.py:1146-1154
  • Leaks a kernel pointer (nf_conntrack_helper) from the corrupted flow dump.ovswrap-poc.py:1328-1342
  • Establishes arbitrary kernel read and decrement primitives by crafting fake SET actions that manipulate tunnel metadata.ovswrap-poc.py:1345-1488ovswrap-poc.py:1497-1536
  • Locates the host sudoers writer process's task_struct and cred via the init_pid_ns idr.ovswrap-poc.py:1684-1713
  • Modifies the host process's credentials (fsuid/fsgid or capability words) to gain root privileges.ovswrap-poc.py:1768-1804
  • Writes a sudoers drop-in file to grant the original user passwordless sudo, then spawns a root shell.ovswrap-poc.py:1840-1862ovswrap-poc.py:608-632
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The PoC exploits CVE-2026-64531 to escalate privileges from an unprivileged user to root by corrupting kernel memory and writing a sudoers entry.This is the normal, documented behavior of the PoC and does not constitute a backdoor.README.md:3ovswrap-poc.py:2025-2137
Embedded Data
The script contains an embedded base85-encoded, zlib-compressed JSON table of pre-derived kernel offsets for approximately 800 x86-64 kernel builds.This is a legitimate technique for a PoC to support multiple kernel versions without requiring dynamic derivation. The data is used solely for the exploit's offset calculations.ovswrap-poc.py:190-192ovswrap-poc.py:328-341
Sudoers Modification
The PoC writes a sudoers drop-in file or appends to /etc/sudoers to grant the launching user passwordless root access.This is the intended privilege escalation outcome described in the README and is not a hidden backdoor.README.md:44ovswrap-poc.py:1840-1939
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the packet due to size limits, but it is not material to the classification.
  • The embedded kernel record table is base85-encoded and compressed; its contents were not decoded or analyzed.
  • One file (unclassified, 18092 bytes) was omitted from the text evidence and was not analyzed; its content is unknown.
  • Binary content within the artifact was not inspected (metadata-only analysis).
  • The review is based solely on the supplied text evidence; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1