CVE-2026-36355

HIGH

Realtek rtl819x - Local Privilege

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-36355 has a selected CVSS score of 7.7 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2026 · Source: CVE List

Proofs of concept

2

Catalogued exploits

ExploitDBRealtek rtl819x - Local PrivilegeExploitDB exploitby Daniil GordeevExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A local privilege escalation exploit for the Realtek rtl819x Wi-Fi driver. It uses unrestricted ioctl handlers (0x89F5/0x89F6) to gain arbitrary kernel read/write, locates the current task_struct, and overwrites its credentials to gain root.

Backdoor review

No backdoor observed in reviewed code

The supplied C source code is a local privilege escalation exploit for CVE-2026-36355. It uses ioctl 0x89F5/0x89F6 to read and write kernel memory, locates the current task_struct, and overwrites credential fields to gain root. All behavior is consistent with the stated exploit purpose; no concealed payload, persistence mechanism, credential exfiltration, or unrelated remote access is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesc
Target softwareRealtek rtl819x Jungle SDK Wi-Fi driver
Attack typeslocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits a vulnerability to escalate privileges. It uses kernel read/write primitives to locate and modify the current process's credentials, then spawns a root shell. This is a full exploit, not just a scanner or writeup.

exploits/linux/local/52580.c:10exploits/linux/local/52580.c:405-419

Requirements

  • Unprivileged local user access on a system with a vulnerable Realtek rtl819x Wi-Fi driver loaded.exploits/linux/local/52580.c:15
  • A network interface using the vulnerable driver must be present.exploits/linux/local/52580.c:99-118

Observed behavior

  • Opens a UDP socket and uses it to send ioctl commands to a network interface.exploits/linux/local/52580.c:340exploits/linux/local/52580.c:61
  • Scans kernel memory for the init_task structure by searching for the string "swapper".exploits/linux/local/52580.c:139-177
  • Auto-detects task_struct field offsets (tasks, pid, cred, comm) from the init_task memory dump.exploits/linux/local/52580.c:188-277
  • Walks the kernel task list to find the task_struct of the current process.exploits/linux/local/52580.c:281-325
  • Overwrites the process's kernel credentials (UID, GID, capabilities) to gain root privileges.exploits/linux/local/52580.c:407-408
  • Executes /bin/sh to provide an interactive root shell.exploits/linux/local/52580.c:419
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThis is the documented vulnerability mechanism for CVE-2026-36355.exploits/linux/local/52580.c:35-36exploits/linux/local/52580.c:48-95
Exploit Behavior
Payload withheldStandard kernel exploitation technique to find and modify the target process's credentials.exploits/linux/local/52580.c:122-277exploits/linux/local/52580.c:281-325
Exploit Behavior
Payload withheldThis is the privilege escalation payload, directly matching the exploit's stated goal.exploits/linux/local/52580.c:405-408
Exploit Behavior
Payload withheldStandard post-exploitation action to provide an interactive root shell.exploits/linux/local/52580.c:419
Review boundaries

What the analysis did not establish

  • Only the supplied C source file was reviewed; no binary or runtime analysis was performed.
  • The exploit's behavior depends on the vulnerable kernel driver; the review does not assess whether the exploit is functional or safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubtotekuh/CVE-2026-36355Repository PoCby totekuh0Exploit5 files

104.8 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a complete, portable local privilege escalation exploit (kpwn.c) for CVE-2026-36355. It uses the vulnerable write_mem/read_mem ioctls in the Realtek rtl819x driver to read and write arbitrary kernel memory, auto-detects task_struct offsets, and overwrites process credentials to gain root from an unprivileged user.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md describing CVE-2026-36355 and a reference exploit (kpwn.c) that demonstrates local privilege escalation by abusing missing access-control checks on debug ioctls in the Realtek rtl819x Jungle SDK Wi-Fi driver. The exploit code performs only the actions necessary to achieve privilege escalation: finding a vulnerable interface, reading/writing kernel memory to locate and overwrite the calling process's credentials, and spawning a root shell. No concealed executable behavior, unrelated payload delivery, persistence mechanisms, or operator-directed harm were observed. The code is straightforward C with no obfuscation or hidden functionality.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesC
Target softwareRealtek rtl819x Jungle SDK Wi-Fi kernel driver (rtl8192cd, rtl8192es, etc.)
Attack typeslocal privilege escalationarbitrary kernel memory read/write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is kpwn.c, a complete C program that actively exploits CVE-2026-36355 to achieve local privilege escalation. It uses the vulnerable ioctls to read and write kernel memory, locates and modifies its own process credentials, and executes a root shell. This is code intended to exercise a vulnerability, not merely detect or document it.

kpwn.c:1-14kpwn.c:330-423

Requirements

  • Local unprivileged user access to a device with a vulnerable Realtek rtl819x Wi-Fi driver loaded and a wireless interface available.kpwn.c:16
  • Ability to open a socket and perform ioctl calls on the wireless interface (may require membership in the 'inet' group on some kernels).kpwn.c:341-347

Observed behavior

  • Scans /sys/class/net to find a wireless interface that responds to the read_mem ioctl (0x89F6) with valid data.kpwn.c:100-119
  • Brute-force scans kernel .data memory region to locate the init_task structure by searching for the 'swapper' string and validating the associated credential structure.kpwn.c:123-178
  • Auto-detects task_struct field offsets (comm, cred, tasks, pid) by analyzing the memory layout of init_task.kpwn.c:189-278
  • Walks the kernel task list to find the task_struct of the current process.kpwn.c:282-326
  • Uses the write_mem ioctl (0x89F5) to overwrite the process's kernel credentials (UID, GID, capability sets) with root-equivalent values.kpwn.c:406-409
  • Spawns a root shell via execl('/bin/sh', 'sh', NULL) after successful credential overwrite.kpwn.c:420
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe exploit leverages the documented vulnerability to overwrite process credentials and gain root. This is the expected and stated purpose of the PoC.kpwn.c:406-410kpwn.c:420
Ioctl Usage
Payload withheldThese ioctl codes correspond to the vulnerable write_mem and read_mem handlers described in the CVE. The exploit uses them exclusively for kernel memory access.kpwn.c:36-37kpwn.c:49-96
Credential Overwrite
Payload withheldThis is the standard technique for privilege escalation via credential structure overwrite. It targets only the calling process's own credentials.kpwn.c:408-409
Review boundaries

What the analysis did not establish

  • The evidence packet includes only the README.md and kpwn.c files. Two other text files and one non-text file (likely the screenshot kpwn-demo.png) are present in the repository but their content is not provided.
  • The analysis is based solely on static review of the provided source code; the exploit was not executed or tested.
  • Three additional files in the repository (totaling 5 files) were not included as text in the evidence packet. Their content is unknown, but the packet metadata indicates they are non-text or were omitted by the selection rule. The review is limited to the provided README.md and kpwn.c.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3