EIP-2026-102644
PRE-CVELinux Kernel - io_submit L2TP sendmsg Integer Overflow
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-102644. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit leverages an integer overflow in the Linux kernel's L2TP PPP sendmsg implementation via the AIO subsystem, leading to kernel heap corruption and potential local privilege escalation on 64-bit systems running older kernel versions (e.g., 3.10, 3.18). The PoC triggers the vulnerability by submitting a crafted IOCB_CMD_PWRITE operation with an excessively large size value.
Description
Linux Kernel - io_submit L2TP sendmsg Integer Overflow
Exploits (1)
This exploit leverages an integer overflow in the Linux kernel's L2TP PPP sendmsg implementation via the AIO subsystem, leading to kernel heap corruption and potential local privilege escalation on 64-bit systems running older kernel versions (e.g., 3.10, 3.18). The PoC triggers the vulnerability by submitting a crafted IOCB_CMD_PWRITE operation with an excessively large size value.