## https://sploitus.com/exploit?id=B59FCA72-29AC-56B2-9998-6615317DCA1F
# Linux Kernel N-Day Exploits
**Local privilege escalation research on patched Linux kernel vulnerabilities**
Patch reversal · root-cause analysis · exploit development · coordinated publication
[](#the-exploits)
[](#the-exploits)
[](#the-exploits)
[](#scope)
[](#read-this-before-you-clone)
[**Rendered index â**](https://www.aviralsrivastava.tech/exploits/) · [aviralsrivastava.tech](https://www.aviralsrivastava.tech)
---
## Read this before you clone
**Neither exploit has been executed against a live vulnerable kernel.** No success rate is
claimed for either.
What *has* been validated: both compile clean under `gcc -Wall -Wextra`, both code paths
were traced against the upstream fix commits, and both version gates were desk-checked
against real distro version strings.
What has **not**: end-to-end execution, success rate, panic rate, and whether the version
gate actually refuses on a patched kernel.
Where a reliability figure would normally sit, the headers read
`RELIABILITY: UNVERIFIED â not empirically measured`. That is deliberate. An unmeasured
number is a fabricated number no matter how carefully it was reasoned to, and public
exploit code has enough of those already. If you run these properly and measure one, send
it and it goes in the README with your name on it.
Run them in a disposable VM. Both may oops the calling process or panic the box.
---
## The exploits
CVE-2026-23231CVSS 7.8 · HIGH
**nf_tables RCU use-after-free â LPE** · kernels **3.16 â 6.19.3**
`nf_tables_addchain()` publishes a new chain to the table's chain list with
`list_add_tail_rcu()` *before* registering its hooks. When `nf_tables_register_hook()`
subsequently fails, the error path calls `nft_chain_del()` and destroys the chain without
an intervening `synchronize_rcu()`. Concurrent RCU readers are still holding it.
Twelve years of kernels, reachable from an unprivileged user namespace.
**Kill chain** â namespace setup â nftables infrastructure â force hook registration
failure under cgroup v2 memory pressure â spray the freed slot with `msg_msg` â leak
kernel addresses by racing `nf_tables_dump_chains()` â overwrite `modprobe_path` â
trigger the helper.
Fixed in 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4
· [`71e99ee2`](https://git.kernel.org/stable/c/71e99ee20fc3f662555118cf1159443250647533)
[`exploit.c`](CVE-2026-23231/exploit.c) · [patch analysis](CVE-2026-23231/patch-analysis.md) · [root cause](CVE-2026-23231/root-cause.md) · [strategy](CVE-2026-23231/exploit-strategy.md)
CVE-2026-22999CVSS 5.5 · MEDIUM
**QFQ packet scheduler use-after-free â LPE** · kernels **3.8 â 6.18.6**
A use-after-free in the QFQ qdisc class-change path, escalated through a cross-CPU double
free into overlapping slab objects.
NVD scores this as a denial of service. It is a privilege escalation.
**Kill chain** â namespaces for `CAP_NET_ADMIN` â QFQ qdisc and class via netlink â
memory pressure â UAF on class change â cross-CPU double free â spray overlapping
objects â leak kernel addresses â overwrite `modprobe_path` â trigger the helper.
Fixed in 5.10.248, 5.15.198, 6.1.161, 6.6.121, 6.12.66, 6.18.6
· [`3879cffd`](https://git.kernel.org/stable/c/3879cffd9d07aa0377c4b8835c4f64b4fb24ac78)
[`exploit.c`](CVE-2026-22999/exploit.c) · [patch analysis](CVE-2026-22999/patch-analysis.md) · [root cause](CVE-2026-22999/root-cause.md) · [strategy](CVE-2026-22999/exploit-strategy.md)
### Mitigations
Both take the data-only route, which is what keeps them viable on modern kernels: no
control-flow hijack means kCFI and SMEP never enter the picture.
| | KASLR | SMEP | SMAP | kCFI | SLUB hardening |
|---|---|---|---|---|---|
| CVE-2026-23231 | bypassed | n/a | n/a | n/a | minimal impact |
| CVE-2026-22999 | bypassed | n/a | n/a | n/a | bypassed |
`n/a` means the technique never needs to defeat it, not that the mitigation is absent.
---
## Vendor patch status at publication
Both bugs are fixed upstream and have been for months. Distribution coverage is uneven,
and the gaps are stated here rather than left for you to find.
**CVE-2026-23231** â Ubuntu fixed ([USN-8244-1](https://ubuntu.com/security/notices/USN-8244-1)) ·
Debian fixed ([DLA-4561-1](https://security-tracker.debian.org/tracker/DLA-4561-1)) ·
RHEL 10 and RHEL 7 ELS fixed · **RHEL 9 affected, no vendor fix released**
**CVE-2026-22999** â Debian fixed ([DLA-4475-1](https://security-tracker.debian.org/tracker/DLA-4475-1)) ·
Ubuntu partial (jammy only, [USN-8162-1](https://ubuntu.com/security/notices/USN-8162-1)) ·
RHEL 9 and 10 not affected · **RHEL 8 and RHEL 7 ELS affected, no vendor fix released
193 days after the upstream fix**
If you run RHEL 8 or RHEL 9, the relevant bug is unpatched on your systems and this
repository contains exploit code for it. That is the situation as it stands, and it is why
these are published rather than held. A fix that has existed upstream for six months and
still has not reached a supported enterprise release is not a fixed bug from the
perspective of the people running it.
---
## Scope
PoC only. Each exploit demonstrates `uid=0` and stops. No persistence, no lateral
movement, no payload delivery, no network callbacks, no anti-forensics.
Each checks the running kernel version and refuses on a patched kernel. That check has not
itself been tested against a patched kernel, so treat it as a courtesy rather than a
guarantee.
## Build
```bash
gcc -Wall -Wextra -static -o exploit exploit.c -lpthread
```
x86_64 Linux. Disposable VM.
## Method
Each directory carries the work, not just the payload:
**`patch-analysis.md`** â the upstream diff, the pre- and post-patch code paths, and the
syscall route to the bug.
**`root-cause.md`** â bug classification, the primitives it yields, the slab cache it
lands in, spray candidates, and what each mitigation does to the approach.
**`exploit-strategy.md`** â the chain, step by step: setup, trigger, reclaim, leak,
escalate, clean up.
The analysis is the durable part. Exploits age out as kernels move; the reasoning about
why a patch was incomplete or where an allocator can be steered does not.
---
## Legal and intent
Published for defensive research, detection engineering, and exploit-development
education. Both vulnerabilities are public, have assigned CVEs, and are fixed upstream.
Run these only on systems you own or are explicitly authorised to test. Unauthorised
access to computer systems is a criminal offence in most jurisdictions. What you do with
this code is your responsibility.
Corrections to the analysis are welcome. Open an issue.
## License
MIT â see [LICENSE](LICENSE).
---
**Aviral Srivastava** â security researcher, AI/ML infrastructure and Linux kernel
CVE-2026-33017 (Langflow, CISA KEV) · CVE-2026-53923 (vLLM) · CVE-2026-32628 (AnythingLLM)
2026 Pwnie Award nominee, Best Server-Side / Cloud Bug
[aviralsrivastava.tech](https://www.aviralsrivastava.tech) · [ORCID](https://orcid.org/0000-0002-6724-4662) · [LinkedIn](https://linkedin.com/in/aviralsrivastava23)