Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-36355. PoCs published by Daniil Gordeev, totekuh.
AI-analyzed exploit summary This is a functional local privilege escalation (LPE) exploit for CVE-2026-36355, targeting the Realtek rtl819x WiFi driver SDK. It leverages missing capability checks on ioctl commands (0x89F5/0x89F6) to achieve arbitrary kernel read/write, auto-detects task_struct offsets, and overwrites credentials to gain root.
Description
The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h
Exploits (2)
This is a functional local privilege escalation (LPE) exploit for CVE-2026-36355, targeting the Realtek rtl819x WiFi driver SDK. It leverages missing capability checks on ioctl commands (0x89F5/0x89F6) to achieve arbitrary kernel read/write, auto-detects task_struct offsets, and overwrites credentials to gain root.
The repository contains a functional exploit for CVE-2026-36355, targeting the Realtek rtl819x Jungle SDK Wi-Fi driver. The exploit leverages unauthenticated IOCTLs to achieve arbitrary kernel memory read/write, leading to local privilege escalation (LPE) from an unprivileged user to root.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N