0xCyberstan/CVE-2026-31694-POC
PoC files
11 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A local privilege escalation exploit for CVE-2026-31694, a FUSE readdir cache out-of-bounds write in the Linux kernel. The exploit.c file implements a FUSE server that returns an oversized dirent, causing a 24-byte heap overflow. It uses page grooming to target the page cache of /etc/passwd, overwriting the root password field to achieve passwordless root access.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2026-31694, a Linux kernel FUSE readdir cache out-of-bounds write. The provided source code (exploit.c, Makefile, README.md) implements the described vulnerability exploitation and local privilege escalation to modify /etc/passwd. No concealed backdoor, unrelated remote access, persistence mechanism, or deceptive payload targeting the person running the PoC was observed. The code's behavior is consistent with the documented exploit functionality.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, compilable C program (exploit.c) that actively exploits CVE-2026-31694 to achieve local privilege escalation by corrupting /etc/passwd. The README describes it as a 'marker PoC for the write primitive and a local privilege escalation' and provides instructions for running it to gain root. This is code intended to exercise a vulnerability, not merely detect it.
README.md:8-10exploit.c:1-19exploit.c:394-527Requirements
- Requires a vulnerable Linux kernel (6.15+ before fix) with FUSE support and a local unprivileged user account.
README.md:12-13 - Requires fusermount3 and the ability to mount FUSE filesystems.
exploit.c:367-369
Observed behavior
- Sets up a malicious FUSE server that returns a dirent with namelen=4095, causing a 24-byte overflow past a page boundary.
exploit.c:193-201 - Drains per-CPU page freelists and allocates a pool of pages to groom physical adjacency between a freed page and the /etc/passwd page cache.
exploit.c:226-256 - Triggers the overflow to overwrite the root entry in /etc/passwd with a passwordless line, then uses su to gain a root shell.
exploit.c:302-353exploit.c:469-521
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- The exploit.c code performs a local privilege escalation by corrupting the /etc/passwd page cache to create a passwordless root account.This is the intended and documented behavior of the PoC, not a hidden backdoor.
exploit.c:56-57exploit.c:302-353exploit.c:461-521 - Payload
- The PAYLOAD string "root::0:0:x:.:\n#######" is written into the kernel page cache to modify /etc/passwd.This payload is directly related to the LPE goal of creating a passwordless root user.
exploit.c:56-57 - Post Exploitation
- After successful corruption, the code uses su to persist the modified /etc/passwd and drop caches.This is part of the documented LPE flow to finalize the privilege escalation.
exploit.c:497-506
What the analysis did not establish
- Only 3 of 11 files in the repository were provided as text; 8 files (including shell scripts in vm/ and a LICENSE file) were omitted due to budget constraints.
- The evidence packet reports complete_artifact_coverage as false, so the full repository content is not available for analysis.
- 8 files (likely shell scripts in the vm/ directory) were omitted from the text evidence. Their content was not reviewed, but the README describes them as VM setup and execution scripts, which is consistent with the PoC's purpose.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.