0xBlackash/CVE-2026-43499

GitHubRepository PoCScanner

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script that checks the kernel version against a hardcoded list to determine if the system is likely vulnerable to CVE-2026-43499. It also includes a crash proof-of-concept that attempts to trigger a kernel panic via futex syscalls, but the primary stated operation is detection and validation, not reliable exploitation.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README documenting CVE-2026-43499 and a Python script (ghostlock_poc.py) that checks kernel version and optionally triggers a crash PoC using futex syscalls. The script performs only the described vulnerability check and crash demonstration; no concealed backdoor, credential theft, persistence, or unrelated payload is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareLinux Kernel
Attack typesUse-After-FreeLocal Privilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script is named 'Safe Checker + Crash PoC' and its primary function is to check the kernel version and report vulnerability status. The crash PoC is described as a dangerous test that may cause a kernel panic, but it does not contain code to gain privileges or achieve reliable exploitation; it only attempts to trigger a crash, which aligns with a scanner/detector role.

ghostlock_poc.py:3ghostlock_poc.py:39-49ghostlock_poc.py:66-68

Requirements

  • Local code execution on a Linux system with a vulnerable kernel version.ghostlock_poc.py:24-37
  • Access to futex system calls.ghostlock_poc.py:57-58

Observed behavior

  • Checks the running kernel version against a hardcoded list of patched versions to report vulnerability status.ghostlock_poc.py:24-37
  • Spawns multiple threads that call futex with FUTEX_LOCK_PI, then calls FUTEX_CMP_REQUEUE_PI in a loop to attempt to trigger a kernel crash.ghostlock_poc.py:60-82
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Futex Syscall
libc.syscall(202, uaddr, op, val, 0, uaddr2, 0)The PoC uses raw futex syscalls (FUTEX_LOCK_PI, FUTEX_CMP_REQUEUE_PI) to trigger the described rtmutex vulnerability, consistent with the documented attack flow.ghostlock_poc.py:58ghostlock_poc.py:62ghostlock_poc.py:79
Kernel Version Check
is_vulnerable_kernel() functionThe script checks the running kernel version against known patched versions before running the PoC, which is normal safety behavior for a vulnerability checker.ghostlock_poc.py:24-37
User Prompt
input('Run dangerous crash PoC? (y/N): ')The script requires explicit user confirmation before executing the crash PoC, indicating no automatic or concealed harmful action.ghostlock_poc.py:91
Review boundaries

What the analysis did not establish

  • The kernel version check uses a hardcoded list of patched versions and may produce false positives or negatives for kernels not explicitly listed.
  • The crash PoC is described as potentially causing a kernel panic, but its reliability and effectiveness are not verified.
  • The artifact does not include a working exploit for privilege escalation; it only attempts to trigger a crash.
  • Only the two text files (README.md, ghostlock_poc.py) were reviewed; no binary or other files were present in the evidence packet.
  • The review does not assess whether the PoC actually triggers the vulnerability or causes kernel panic; it only evaluates the presence of backdoor or deceptive behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1