https://poc.intelseclab.com/tags/linux-kernel/Latest proof-of-concept entries.Hugoen-usSun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/Sun, 09 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-09_cve-2026-64561-zapscape-kvm-shadow-mmu-guest-to-host/High severity (CVSS 8.8) — binary · CVE-2026-64561. Status: Patched. Affects: Linux kernel, KVM/x86 shadow-MMU (nested EPT/NPT shadowing) — arch/x86/kvm/mmu/mmu.c and arch/x86/kvm/mmu/paging_tmpl.h. Tags: linux-kernel, kvm, x86, shadow-mmu, nested-virtualization, svm, npt, ept, guest-to-host-escape, vm-escape, use-after-free, CWE-416, cross-cache, kaslr-bypass, usermode-helper, virtualization.binaryHighlinux-kernelkvmx86shadow-mmunested-virtualizationsvmnpteptguest-to-host-escapevm-escapeuse-after-freeCWE-416cross-cachekaslr-bypassusermode-helpervirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-27_cve-2026-46316-itscape-kvm-arm64-vgic-its-escape/Critical severity (CVSS 9.3) — binary · CVE-2026-46316 (GHSA-qcxh-2cm7-9fcc). Status: Weaponized. Affects: Linux kernel, KVM/arm64 in-kernel vGIC-ITS (Interrupt Translation Service) emulation (arch/arm64/kvm/vgic/vgic-its.c). Tags: linux-kernel, kvm, arm64, vgic-its, guest-to-host-escape, vm-escape, double-free, use-after-free, kaslr-bypass, heap-grooming, virtualization.binaryCriticallinux-kernelkvmarm64vgic-itsguest-to-host-escapevm-escapedouble-freeuse-after-freekaslr-bypassheap-groomingvirtualizationhttps://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/Wed, 08 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-08_cve-2026-43499-ghostlock-nebula-security/High severity (CVSS 7.8) — binary · CVE-2026-43499 (aka "GhostLock"). Status: Weaponized (per Nebula Security disclosure); no exploit code mirrored into this repo, see Notes. Affects: Linux kernel — rtmutex priority-inheritance (futex-PI) subsystem, CONFIG_FUTEX_PI. Tags: linux-kernel, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, container-escape, kernelctf, ghostlock.binaryHighlinux-kerneluse-after-freefutexrtmutexpriority-inheritancelpelocalcontainer-escapekernelctfghostlockhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43494-pintheft-nasm-kernel-lpe/High severity — binary · CVE-2026-43494. Status: PoC. Affects: Linux kernel (RDS zerocopy send path + io_uring fixed buffers). Tags: linux-kernel, lpe, double-free, use-after-free, rds, io_uring, page-cache-overwrite, x86_64, nasm, asm, local, root-shell.binaryHighlinux-kernellpedouble-freeuse-after-freerdsio_uringpage-cache-overwritex86_64nasmasmlocalroot-shellhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53075-ppp-userns-probe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53075-ppp-userns-probe/Info severity — binary · CVE-2026-53075. Status: PoC. Affects: Linux kernel, PPP (/dev/ppp) subsystem. Tags: linux-kernel, ppp, user-namespace, unshare, ioctl, privilege-check, cwe-284.binaryInfolinux-kernelpppuser-namespaceunshareioctlprivilege-checkcwe-284https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-23416-linux-kernel-mseal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-23416-linux-kernel-mseal/Medium severity — binary · CVE-2026-23416. Status: PoC. Affects: Linux kernel, mm/mseal.c / mm/vma.c (mseal_apply() / vma_merge_existing_range()). Tags: linux-kernel, mseal, mm-subsystem, vma, logic-error, unprivileged, security-feature-bypass, memfd.binaryMediumlinux-kernelmsealmm-subsystemvmalogic-errorunprivilegedsecurity-feature-bypassmemfdhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31429-linux-kfence-skb-crosscache/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31429-linux-kfence-skb-crosscache/Medium severity — binary · CVE-2026-31429. Status: PoC. Affects: Linux kernel — net/core/skbuff.c (skb_kfree_head()) via bpf_prog_test_run_skb. Tags: linux-kernel, kfence, cross-cache, slab-corruption, ebpf, skb, cwe-763, use-after-free-adjacent.binaryMediumlinux-kernelkfencecross-cacheslab-corruptionebpfskbcwe-763use-after-free-adjacenthttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/High severity — network · CVE-2026-23398. Status: PoC. Affects: Linux kernel, icmp_tag_validation() / icmp_unreach() in net/ipv4/icmp.c. Tags: linux-kernel, icmp, denial-of-service, null-pointer-dereference, kernel-panic, pmtu, scapy, remote-dos.networkHighlinux-kernelicmpdenial-of-servicenull-pointer-dereferencekernel-panicpmtuscapyremote-doshttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf/High severity (CVSS 7.8) — binary · CVE-2026-43499. Status: PoC. Affects: Linux kernel — kernel/locking/rtmutex.c, futex-PI subsystem (futex_requeue() / rt_mutex_start_proxy_lock()). Tags: linux-kernel, android, use-after-free, futex, rtmutex, priority-inheritance, lpe, local, kernel-panic, ndk.binaryHighlinux-kernelandroiduse-after-freefutexrtmutexpriority-inheritancelpelocalkernel-panicndkhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31694-fuse-readdir-cache-oob/High severity — binary · CVE-2026-31694. Status: Weaponized. Affects: Linux kernel — fs/fuse/readdir.c (fuse_add_dirent_to_cache()). Tags: linux-kernel, fuse, oob-write, page-cache, lpe, groom, unprivileged, qemu-kvm.binaryHighlinux-kernelfuseoob-writepage-cachelpegroomunprivilegedqemu-kvmhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31413-bpf-verifier-container-escape/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31413-bpf-verifier-container-escape/Critical severity — binary · CVE-2026-31413. Status: Weaponized. Affects: Linux kernel — BPF verifier (maybe_fork_scalars()). Tags: linux-kernel, ebpf, bpf-verifier, container-escape, modprobe-path, gke, lpe, vtable-hijack.binaryCriticallinux-kernelebpfbpf-verifiercontainer-escapemodprobe-pathgkelpevtable-hijackhttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53360-kvm-sev-snp-psc-heap-oob/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-53360-kvm-sev-snp-psc-heap-oob/High severity — binary · CVE-2026-53360. Status: PoC. Affects: Linux KVM host, SEV-SNP support (arch/x86/kvm/svm/sev.c, snp_begin_psc() / setup_vmgexit_scratch()). Tags: kvm, sev-snp, kernel, heap-oob, kasan, guest-escape, slab, kmalloc-cg, linux-kernel, cwe-125, cwe-787.binaryHighkvmsev-snpkernelheap-oobkasanguest-escapeslabkmalloc-cglinux-kernelcwe-125cwe-787https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-31635-dirtydecrypt-go-rxgk-lpe/High severity — binary · CVE-2026-31635. Status: Weaponized. Affects: Linux kernel — net/rxrpc/rxgk_common.h (rxgk_decrypt_skb()). Tags: linux-kernel, lpe, rxrpc, rxgk, page-cache, dirty-pipe-variant, splice, golang, unprivileged.binaryHighlinux-kernellperxrpcrxgkpage-cachedirty-pipe-variantsplicegolangunprivilegedhttps://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/Tue, 30 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-30_cve-2026-46331-linux-act-pedit-lpe/High severity (CVSS 7.8) — binary · CVE-2026-46331. Status: PoC. Affects: Linux Kernel — net/sched/act_pedit (traffic control packet editing). Tags: LPE, Linux kernel, COW, page-cache, act_pedit, tc, netlink, traffic-control, privilege-escalation, userns, C, DirtyFrag.binaryHighLPELinux kernelCOWpage-cacheact_pedittcnetlinktraffic-controlprivilege-escalationusernsCDirtyFraghttps://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/Sun, 28 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-28_dirtyclone-cve-2026-43503-lpe/High severity (CVSS 8.8) — binary · CVE-2026-43503. Status: Weaponized. Affects: Linux kernel (netfilter TEE / __pskb_copy_fclone()). Tags: LPE, Linux kernel, netfilter, TEE, IPsec, XFRM, page-cache, file-backed memory, DirtyFrag, skb, privilege escalation, C, in-the-wild.binaryHighLPELinux kernelnetfilterTEEIPsecXFRMpage-cachefile-backed memoryDirtyFragskbprivilege escalationCin-the-wildhttps://poc.intelseclab.com/pocs/binary/2026-06-05_ssh-keysign-pwn/Fri, 05 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-05_ssh-keysign-pwn/High severity — binary · CVE-2026-46333. Status: Patched. Affects: Linux kernel plus privileged userland binaries (ssh-keysign, chage). Tags: LPE, Linux kernel, pidfd_getfd, ptrace, ssh-keysign, chage, fd-theft.binaryHighLPELinux kernelpidfd_getfdptracessh-keysignchagefd-thefthttps://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/Wed, 20 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-20_pintheft-rds-double-free/High severity — binary. Status: Weaponized. Affects: Linux kernel (RDS subsystem + io_uring). Tags: LPE, double-free, use-after-free, Linux kernel, RDS, io_uring, page-cache-overwrite, x86_64, local.binaryHighLPEdouble-freeuse-after-freeLinux kernelRDSio_uringpage-cache-overwritex86_64localhttps://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-18_dirtydecrypt/High severity — binary · N/A (reported as duplicate by kernel maintainers; patched on mainline). Status: Weaponized. Affects: Linux kernel — net/rxrpc (rxgk_decrypt_skb). Tags: LPE, Linux kernel, page-cache, rxgk, RxRPC, COW, write-primitive, unprivileged, Dirty-Pipe-variant, splice, MSG_SPLICE_PAGES.binaryHighLPELinux kernelpage-cacherxgkRxRPCCOWwrite-primitiveunprivilegedDirty-Pipe-variantspliceMSG_SPLICE_PAGEShttps://poc.intelseclab.com/pocs/binary/2026-05-17_linux-vsock-vm-escape/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-vsock-vm-escape/High severity (CVSS 7.8) — binary · CVE-2025-21756. Status: Weaponized. Affects: Linux kernel (vsock / virtual socket subsystem). Tags: UAF, Linux kernel, vsock, VM escape, container escape, virtualization, LPE, x64.binaryHighUAFLinux kernelvsockVM escapecontainer escapevirtualizationLPEx64https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_linux-nftables-uaf-lpe/High severity (CVSS 7.8) — binary · CVE-2024-1086. Status: Weaponized. Affects: Linux kernel (netfilter nf_tables subsystem). Tags: LPE, UAF, Linux kernel, nf_tables, netfilter, CISA KEV, ransomware, x64.binaryHighLPEUAFLinux kernelnf_tablesnetfilterCISA KEVransomwarex64https://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-17_copy-fail-cve-2026-31431/High severity — binary · CVE-2026-31431. Status: Weaponized. Affects: Linux kernel (crypto / AF_ALG AEAD path). Tags: LPE, Linux kernel, AF_ALG, authenc, splice, local, Python.binaryHighLPELinux kernelAF_ALGauthencsplicelocalPythonhttps://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-rxrpc-lpe/Thu, 14 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-05-14_linux-xfrm-rxrpc-lpe/Critical severity (CVSS 7.8) — binary · CVE-2026-43500, CVE-2026-43284. Status: Weaponized. Affects: Linux kernel. Tags: LPE, Linux kernel, page-cache, xfrm, RxRPC, local, unauthenticated, Dirty Pipe variant.binaryCriticalLPELinux kernelpage-cachexfrmRxRPClocalunauthenticatedDirty Pipe variant