## https://sploitus.com/exploit?id=AED32642-D0A9-5EC1-80C1-993002887242
# CVE-2026-53365 — VsockDrop:io_uring + AF_VSOCK: Improper reference counting of copy-on-write, and modification of Page-Cache to gain privilege escalation
>HackSpeak distributes this image. **This repository is a distribution image for MaherAzzouzi/vsockdrop**. The code is consistent with the upstream source. The upstream does not include a license. The image follows distribution conventions and uses **MIT License, Copyright (c) 2026 HackSpeak**. The source code copyright belongs to the original author, MaherAzzouzi.**
> ⚠️ **This image includes a complete local privilege escalation exploit**—it modifies the page cache of `/usr/bin/su` (which may persist on the disk under CoW file systems). This image is intended only for security research, vulnerability testing, and authorized tests. **It should only be run in an isolated environment where you have ownership or explicit authorization**. Do not use it on unauthorized systems. ## Description of the vulnerability
**VsockDrop(CVE-2026-53365)** is a vulnerability in the **copy-on-write mechanism** used by the Linux kernel’s **io_uring framework**. It involves improper handling of reference counts, which can lead to **local privilege escalation without privileges**.
- **Root cause**: When multiple vsocks are sent, `io_uring` uses `SKBFL_MANAGED_FRAG_REFS`, but the vsock paths do not follow this flag. As a result, `__skb_frag_unref()` calls `put_page()` on managed pages. This causes an additional `put_page` call each time data is sent, directly reducing the pin count.
- **Exploitation chain**:
1. **Reference count overflow**: By performing 1024 `SEND_ZC` calls, the reference count is reduced from 1 to 0. The still-pinned pages are then released to the PCP freelist.
2. **Page-cache recycling**: A single `pread` of `/usr/bin/su` retrieves the newly released PFN from the LIFO freelist. This page is also associated with the io_uring fixed buffer and the su page-cache alias.
3. **PT_INTERP modification**: The `PT_INTERP` string in the su page is modified using `write_fixed`/`read_fixed` to point to the attacker’s loader path.
4. **Data-only privilege escalation**: `exec("/usr/bin/su)` (with setuid-root) maps the attacker’s loader to the interpreter. With root credentials, the system enters as root shell.
- **Affected versions**: Linux **6.7 → 7.0.10**. Fixes available in **7.0.11** and subsequent stable branches.
- **Exploitation conditions**: No user namespaces are required; a single static binary is sufficient.
- **CVSS score**: NVD score is **5.5** (for impact severity), but the author believes it should be **7.8** (for LPE). ## Usage
```bash
make
./exploit
```
> ⚠️ **Warning**: The exploit modifies the content of `/usr/bin/su` in the page cache. In CoW file systems like Btrfs and ZFS, this modification may persist on the disk. **Only run this in a destructible isolated environment**. ## Disclaimer
- **This exploit is intended only for security research, vulnerability testing, and defensive testing**. Please run it in a destructible environment. Do not use it on unauthorized systems. This exploit is for defensive research purposes, and responsible disclosure has been made to security@kernel.org. Please ensure that the target system is owned by you or has explicit authorization before using it. ## Reference links
- **Upstream source repository**: https://github.com/MaherAzzouzi/vsockdrop
- NVD: [CVE-2026-53365](https://nvd.nist.gov/vuln/detail/CVE-2026-53365)
- Upstream patches:
- https://git.kernel.org/stable/c/ae38d9179190a956e2a87a69ef1dd6f451b51c4d
- https://git.kernel.org/stable/c/76b995bc57bd90cb6e954e1966fbd8786da47f0d
- https://git.kernel.org/stable/c/b3155f2b78db21e99256bcf7eb902f24ff6d5338
- Ubuntu security announcement: https://ubuntu.com/security/CVE-2026-53365
- Author’s demonstration: https://x.com/maherazz2/status/2088233024424919395