EIP-2026-102636

The exploit demonstrates a vulnerability in the Linux kernel's userfaultfd API, allowing a user with read-only access to a tmpfs file to write data into holes in the file. The proof-of-concept code registers a userfaultfd region for a read-only shared mapping and uses the UFFDIO_COPY ioctl to write data into the file, bypassing the read-only restriction.