0xBlackash/CVE-2026-53359

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Linux kernel module (CVE-2026-53359.c) that exploits CVE-2026-53359, a use-after-free vulnerability in KVM's shadow MMU, to cause a host denial-of-service. It sets up nested paging, runs a writer thread that races a PDE mapping between a 2MB huge page and a 4KB table, and launches multiple vCPU threads to trigger the bug, leading to a kernel panic.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Linux kernel module (CVE-2026-53359.c) and a README.md file. The kernel module is a proof-of-concept (PoC) for CVE-2026-53359, a KVM shadow paging use-after-free vulnerability. It sets up nested page tables and races a page table entry modification to trigger the described vulnerability, leading to a host kernel denial-of-service (DoS). The code performs only the actions necessary to demonstrate the vulnerability: allocating memory, configuring VMX/SVM virtualization, and running a guest that triggers the race condition. No backdoor, concealed payload, credential theft, persistence mechanism, or unrelated remote access behavior is observed. The README.md describes the vulnerability and its impact, consistent with the PoC's purpose.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesC
Target softwareLinux KernelKVM
Attack typesDenial of ServiceUse-After-Free
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a complete, compilable Linux kernel module (CVE-2026-53359.c) that actively triggers the described vulnerability to cause a host crash. It includes code to set up VMX/SVM virtualization, configure nested page tables, and race a PDE mapping to induce a use-after-free, which is the definition of exploit code.

CVE-2026-53359.c:1-978

Requirements

  • Requires root or CAP_SYS_MODULE to load the kernel module.CVE-2026-53359.c:977
  • Requires a vulnerable Linux kernel with KVM shadow paging support and the kvm_intel or kvm_amd module unloaded.CVE-2026-53359.c:7CVE-2026-53359.c:900-901

Observed behavior

  • Allocates and configures nested page tables (EPT/NPT) to create a scenario where a PDE mapping is raced between a 2MB huge page and a 4KB table, causing a role mismatch in the shadow MMU.CVE-2026-53359.c:741-831
  • Launches a writer kernel thread that continuously flips a PDE entry between a huge page and a table pointer, and multiple vCPU threads that execute guest code to trigger MMU operations, leading to a use-after-free and host kernel panic.CVE-2026-53359.c:838-877
  • The README documents the expected outcome as a kernel panic with a call trace in pte_list_remove and kvm_mmu_page_get_gfn, confirming the DoS impact.README.md:75-89
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Trigger
Race condition on nested page table entry (PDE) modification to trigger KVM shadow paging use-after-freeThe PoC demonstrates the CVE-2026-53359 vulnerability by toggling a PDE between a huge page and a table entry while guest code executes, causing a role mismatch and subsequent use-after-free in the host kernel.CVE-2026-53359.c:849-856
Kernel Module Metadata
MODULE_LICENSE("GPL"), MODULE_DESCRIPTION("KVM guest->host DoS"), MODULE_AUTHOR("Ashraf Zaryouh (0xBlackash)")Standard kernel module metadata identifying the author and purpose, consistent with a legitimate PoC.CVE-2026-53359.c:38-40
Review boundaries

What the analysis did not establish

  • The evidence includes only the source code and README; no binary, build artifacts, or runtime logs are provided to confirm successful execution.
  • The README claims a guest-to-host escape exploit exists but the public release is primarily a DoS demonstration; the provided code is a DoS exploit, not a full escape.
  • Only the two text files (CVE-2026-53359.c and README.md) were reviewed; no binary files were present or analyzed.
  • The review does not assess whether the PoC successfully triggers the vulnerability or is safe to execute; it only evaluates the presence of backdoor or deceptive behavior within the supplied code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1