CVE-2026-46215

Classification basis

The artifact contains a complete, functional exploit (poc.c) that exercises the CVE-2026-46215 vulnerability to achieve local privilege escalation by overwriting /etc/passwd. The README explicitly describes it as an exploit and provides a full exploitation chain.

Requirements

• Access to a DRM render node (/dev/dri/renderD* or /dev/dri/card*)README.md:5-7
• A vulnerable Linux kernel (v6.18-rc1 through 6.18.31, 6.19 through 7.0.8, 7.1-rc1/rc2) built without CONFIG_KASANREADME.md:11-13README.md:68-69
• A supported DRM driver (virtio_gpu or nouveau) that exposes object size/name at expected offsetsREADME.md:70-71

Observed behavior

• Races DRM_IOCTL_GEM_CHANGE_HANDLE and DRM_IOCTL_GEM_CLOSE to create a dangling GEM handlepoc.c:158-186poc.c:346-422
• Sprays pipe_buffers to reclaim the freed GEM object's slab slotpoc.c:302-332
• Leaks a kernel pointer (pipe_buf_ops) via a driver info ioctl to bypass KASLRpoc.c:538-550
• Uses DRM_IOCTL_GEM_FLINK to set PIPE_BUF_FLAG_CAN_MERGE on the overlapping pipe_bufferpoc.c:572-592
• Writes to pipes to merge data into the page cache and overwrite /etc/passwd with a passwordless root entrypoc.c:595-604

Observables

Exploit Behavior

Payload withheldThe entire codebase implements the described exploit chain against the targeted CVE. No actions beyond the stated LPE are performed.poc.c:1-655run_exploit.sh:1-146

Target File Modification

Payload withheldThe exploit's final payload writes a passwordless root entry to /etc/passwd, which is the documented goal of the PoC.poc.c:596-598poc.c:626-632

Network Activity

Payload withheldNo network sockets, connections, or data exfiltration are present in the code.poc.c:1-655

Persistence Mechanism

Payload withheldThe exploit modifies /etc/passwd for immediate privilege escalation but does not install any persistent backdoor, cron job, or service.poc.c:1-655

Classification basis

The artifact contains complete C source code that actively exploits CVE-2026-46215 to achieve local privilege escalation by overwriting payload withheld and spawning a root shell. It does not merely detect or report the vulnerability; it exercises the use-after-free to corrupt memory and escalate privileges.

Requirements

• User must be in the 'video' group to open /dev/dri.README.md:74-89
• The system must have a virtio DRM device available.exploit.c:149-175
• The target kernel must be Linux 7.0 (vulnerability exists from 7.0 to 7.0.8).README.md:30-32exploit.c:14-16

Observed behavior

• Opens a virtio DRM device from /dev/dri.exploit.c:149-175
• Creates a GEM buffer object and races DRM_IOCTL_GEM_CHANGE_HANDLE with DRM_IOCTL_GEM_CLOSE to produce a dangling handle.exploit.c:215-247
• Performs heap grooming (defrag, migration, pipe spray) to reclaim the freed GEM object's slab page with pipe buffers.exploit.c:443-545
• Uses the dangling handle with DRM_IOCTL_VIRTGPU_RESOURCE_INFO to leak a kernel pointer for KASLR bypass.exploit.c:547-558
• Writes a crafted 'oot::0:0:dirty:/root:/bin/sh' payload into the pipe buffers to overwrite payload withheld.exploit.c:338exploit.c:562-565
• Spawns a root shell via 'su - root' after successfully overwriting payload withheld.exploit.c:285-335exploit.c:572-583

Observables

Payload

Payload withheldThe exploit writes this string into payload withheld via pipe spray to create a root-equivalent user 'dirty' with UID 0, which is the standard LPE technique for this class of exploit.exploit.c:338exploit.c:564

Privilege Escalation

Payload withheldAfter overwriting payload withheld, the exploit calls root("root") which forkpty's and exec's /bin/su to provide an interactive root shell. This is the intended outcome of the LPE.exploit.c:285-335exploit.c:583

Target File

Payload withheldThe exploit targets payload withheld for overwrite, a common LPE target. It also creates a dummy payload withheld if missing, which is part of the exploit setup.exploit.c:92exploit.c:401-412