0xCyberstan/CVE-2026-46215-POC

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A full local privilege escalation exploit for CVE-2026-46215, a use-after-free in the Linux kernel's DRM GEM change_handle ioctl. The exploit races GEM_CHANGE_HANDLE against GEM_CLOSE to create a dangling handle, reclaims the freed object with a pipe_buffer spray, leaks a kernel pointer to bypass KASLR, uses FLINK to set the PIPE_BUF_FLAG_CAN_MERGE flag, and overwrites /etc/passwd to create a passwordless root account.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2026-46215, a Linux kernel DRM GEM use-after-free vulnerability. The code performs a local privilege escalation by racing ioctls, reclaiming freed memory with pipe buffers, leaking a kernel pointer, and overwriting /etc/passwd via a DirtyPipe-style technique. All behavior is consistent with the stated exploit goal; no concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagescshell
Target softwarelinux kerneldrm subsystem
Attack typesuse-after-freerace conditionlocal privilege escalationkaslr bypassdirty pipe
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional exploit (poc.c) that exercises the CVE-2026-46215 vulnerability to achieve local privilege escalation by overwriting /etc/passwd. The README explicitly describes it as an exploit and provides a full exploitation chain.

README.md:1-8README.md:39-49poc.c:1-8

Requirements

  • Access to a DRM render node (/dev/dri/renderD* or /dev/dri/card*)README.md:5-7
  • A vulnerable Linux kernel (v6.18-rc1 through 6.18.31, 6.19 through 7.0.8, 7.1-rc1/rc2) built without CONFIG_KASANREADME.md:11-13README.md:68-69
  • A supported DRM driver (virtio_gpu or nouveau) that exposes object size/name at expected offsetsREADME.md:70-71

Observed behavior

  • Races DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE to create a dangling GEM handlepoc.c:158-186poc.c:346-422
  • Sprays pipe_buffers to reclaim the freed GEM object's slab slotpoc.c:302-332
  • Leaks a kernel pointer (pipe_buf_ops) via a driver info ioctl to bypass KASLRpoc.c:538-550
  • Uses DRM_IOCTL_GEM_FLINK to set PIPE_BUF_FLAG_CAN_MERGE on the overlapping pipe_bufferpoc.c:572-592
  • Writes to pipes to merge data into the page cache and overwrite /etc/passwd with a passwordless root entrypoc.c:595-604
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Local privilege escalation via kernel UAF, pipe spray, KASLR bypass, and /etc/passwd overwriteThe entire codebase implements the described exploit chain against the targeted CVE. No actions beyond the stated LPE are performed.poc.c:1-655run_exploit.sh:1-146
Target File Modification
/etc/passwd overwritten to remove root passwordThe exploit's final payload writes a passwordless root entry to /etc/passwd, which is the documented goal of the PoC.poc.c:596-598poc.c:626-632
Network Activity
NoneNo network sockets, connections, or data exfiltration are present in the code.poc.c:1-655
Persistence Mechanism
NoneThe exploit modifies /etc/passwd for immediate privilege escalation but does not install any persistent backdoor, cron job, or service.poc.c:1-655
Review boundaries

What the analysis did not establish

  • Evidence is limited to the three text files provided (README.md, poc.c, run_exploit.sh). No binary files were inspected.
  • The exploit's reliability and safety are not verified; the analysis is based solely on the supplied source code and documentation.
  • Review is based solely on the supplied text files; no binary analysis was performed.
  • The artifact's behavior was not executed or dynamically verified.
  • The review does not assess the safety or reliability of the exploit code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1