EIP-2026-102636
PRE-CVELinux - 'userfaultfd' Bypasses tmpfs File Permissions
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-102636. PoCs published by Google Security Research.
AI-analyzed exploit summary The exploit demonstrates a vulnerability in the Linux kernel's userfaultfd API, allowing a user with read-only access to a tmpfs file to write data into holes in the file. The proof-of-concept code registers a userfaultfd region for a read-only shared mapping and uses the UFFDIO_COPY ioctl to write data into the file, bypassing the read-only restriction.
Description
Linux - 'userfaultfd' Bypasses tmpfs File Permissions
Exploits (1)
The exploit demonstrates a vulnerability in the Linux kernel's userfaultfd API, allowing a user with read-only access to a tmpfs file to write data into holes in the file. The proof-of-concept code registers a userfaultfd region for a read-only shared mapping and uses the UFFDIO_COPY ioctl to write data into the file, bypassing the read-only restriction.