---

## Catalog

1. CVE-2015-8550
2. CVE-2016-9793
3. 4-20-BPF-integer
4. CVE-2017-5123
5. CVE-2017-6074
6. CVE-2017-7308
7. CVE-2017-8890
8. CVE-2017-11176
9. CVE-2017-16995
10. CVE-2017-1000112
11. CVE-2018-5333
12. CVE-2019-9213 & CVE-2019-8956
13. CVE-2019-15666
14. CVE-2020-8835
15. CVE-2020-27194
16. CVE-2021-3156
17. CVE-2021-31440
18. CVE-2021-3490
19. CVE-2021-22555
20. CVE-2021-41073
21. CVE-2021-4154
22. CVE-2021-42008
23. CVE-2021-43267
24. CVE-2022-0185
25. CVE-2022-0847
26. CVE-2022-0995
27. CVE-2022-1015
28. CVE-2022-2588
29. CVE-2022-2602
30. CVE-2022-2639
31. CVE-2022-25636
32. CVE-2022-27666
33. CVE-2022-32250
34. CVE-2022-34918
35. CVE-2023-2598
36. CVE-2024-1086
37. CVE-2025-21702
38. CVE-2026-23271

---

## Detail

#### 1.CVE-2015-8550

[writeup](https://blog.csdn.net/panhewu9919/article/details/100891770) 

**Test version**: Linux-4.19.65

**Protection**: kaslr/SMEP enabled, SMAP disabled.

**Vulnerability**: A **double-fetch vulnerability** caused by gcc compiler optimization, which can directly hijack the control flow.

#### 2. CVE-2016-9793

[writeup](https://blog.csdn.net/panhewu9919/article/details/120164051) 

**Test version**: Linux-4.8.13

**Protection**: KASLR/SMAP/SMEP disabled. The forged [skb_shared_info](https://elixir.bootlin.com/linux/v4.8.13/source/include/linux/skbuff.h#L414) structure resides in user space, so it obviously cannot bypass SMAP.

**Vulnerability**: The [sock_setsockopt()](https://elixir.bootlin.com/linux/v4.8.13/source/net/core/sock.c#L658) function in `net/core/sock.c` **incorrectly handles negative values**, causing `sk_sndbuf` and `sk_rcvbuf` to become negative. When `write` is called, `skb->head` and `skb->end` are set incorrectly, and finally when `close` is called, the free operation accesses user space and triggers an error. A [skb_shared_info](https://elixir.bootlin.com/linux/v4.8.13/source/include/linux/skbuff.h#L414) structure is forged at user-space address `0xfffffed0`, and the control flow is hijacked via `skb_shared_info->destructor_arg->callback`.

#### 3. 4-20-BPF-integer

[writeup](https://www.cnblogs.com/bsauce/p/11560224.html) 

**Test version**: Linux-4.20.0-rc3

**Protection**: SMEP enabled, kaslr/SMAP disabled.

**Vulnerability**: An **integer overflow** vulnerability in `queue_stack_map_alloc()` in the Linux eBPF module leads to a heap overflow. The vtable pointer is overwritten to hijack the control flow to `xchg eax, esp`.

#### 4.CVE-2017-5123

[writeup](https://www.jianshu.com/p/90a040114188) 

**Test version**: Linux 4.14-rc4

**Protection**: SMEP/SMAP enabled, KASLR disabled.

**Vulnerability**: The `waitid` implementation in `/kernel/exit.c` does not call `access_ok()` to validate the user-space address when calling `unsafe_put_user()` to copy kernel data to a user-space address, which means data can actually be copied to kernel-space addresses. **waitid fails to validate the user address, resulting in a null arbitrary-address write.** Privilege escalation can be achieved by executing shellcode at address 0 or by overwriting a cred structure within a guessed range.

#### 5.CVE-2017-6074

[writeup](https://bsauce.github.io/2021/09/17/CVE-2017-6074/)      [reference](https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-6074)

**Test version**: Linux-4.9.12

**Protection**: SMEP/SMAP enabled, kASLR disabled.

**Vulnerability**: In the DCCP (Datagram Congestion Control Protocol) of the Linux kernel's IPv6 protocol family, the [dccp_rcv_state_process()](https://elixir.bootlin.com/linux/v4.9.12/source/net/dccp/input.c#L574) function in `net/dccp/input.c` incorrectly handles the `DCCP_PKT_REQUEST` packet data structure in the `LISTEN` state. When a user calls `setsockopt()` with the `IPV6_RECVPKTINFO` option, a **double-free of the `sk_buff` structure** is triggered. The exploitation method is similar to CVE-2016-8655. The first trigger of the vulnerability uses heap spraying to forge the `po->rx_ring->prb_bdqc->retire_blk_timer` structure and executes `native_write_cr4(0x406e0)` to disable SMEP/SMAP; the second trigger uses heap spraying to forge the `skb->...->destructor_arg` structure and executes `commit_creds(prepare_kernel_cred(0))` for privilege escalation.

#### 6.CVE-2017-7308

[writeup](https://www.jianshu.com/p/b53862cd64a6)      [reference](https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-7308)

**Test version**: Linux-4.10.6

**Protection**: SMEP/SMAP enabled, KASLR disabled.

**Vulnerability**: The [`packet_set_ring()`](https://elixir.bootlin.com/linux/v4.10.6/source/net/packet/af_packet.c#L4181) function in `net/packet/af_packet.c` does not correctly check the block size; the length validation condition is wrong, leading to a **heap overflow**. It requires `CAP_NET_RAW` privileges. The function pointer is hijacked twice: first to disable SMEP/SMAP protections, then to escalate privileges.

#### 7.CVE-2017-8890

[writeup](https://www.jianshu.com/p/699de662f567)      [reference](https://xz.aliyun.com/t/2383)

**Test version**: Linux-4.10.15

**Protection**: SMEP enabled, kASLR/SMAP disabled.

**Vulnerability**: The [`inet_csk_clone_lock()`](https://elixir.bootlin.com/linux/v4.10.15/source/net/ipv4/inet_connection_sock.c#L652) function in `net/ipv4/inet_connection_sock.c` has a **double-free** vulnerability. The double-free is used to tamper with the RCU callback function pointer, disable SMEP, and jump to shellcode to modify cred.

#### 8.CVE-2017-11176

[writeup](https://www.jianshu.com/p/76041ec5c59f) 

**Test version**: Linux-4.11.9

**Protection**: SMEP enabled, kASLR/SMAP disabled.

**Vulnerability**: In the POSIX message queue implementation in the Linux kernel, the `mq_notify()` function does not set the sock pointer to null, leading to UAF. Actually, this is a **race-condition-induced double-free vulnerability**, but the race window can be extended indefinitely.

#### 9.CVE-2017-16995

[writeup](https://www.cnblogs.com/bsauce/p/11583310.html) 

**Test version**: Linux-4.4.110

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: The Linux eBPF module has an **integer extension** problem. The main issue is that the register value types of the two differ, causing the check function and the actual execution function to behave inconsistently. This vulnerability does not involve stack attacks or control-flow hijacking; it only uses syscall data for privilege escalation, making it a typical application of data-oriented attacks on the Linux kernel.

#### 10. CVE-2017-1000112

[writeup](https://www.jianshu.com/p/1fa163fd5b82)  	  [reference](https://bbs.pediy.com/thread-265319.htm)

**Test version**: Linux-4.12.6

**Protection**: SMEP enabled, SMAP/kaslr disabled.

**Vulnerability**: [`__ip_append_data()`](https://elixir.bootlin.com/linux/v4.12.6/source/net/ipv4/ip_output.c#L910) in `net/ipv4/ip_output.c` does not ensure consistency in UDP packet processing, so when sending packets twice, the path can switch from the UFO path to the non-UFO path, resulting in a **heap overflow**. During exploitation, the control flow can be hijacked by overwriting `skb_shared_info->destructor_arg->callback`.

#### 11. CVE-2018-5333

[writeup](https://blog.csdn.net/panhewu9919/article/details/119153052)  

**Test version**: Linux-4.14.13

**Protection**: SMEP enabled, SMAP/kaslr disabled.

**Vulnerability**: In the [`rds_cmsg_atomic()`](https://elixir.bootlin.com/linux/v4.14.13/source/net/rds/rdma.c#L788) function in `net/rds/rdma.c`, forgetting to set `rm->atomic.op_active` to 0 causes a **null-pointer dereference** when [rds_atomic_free_op()](https://elixir.bootlin.com/linux/v4.14.13/source/net/rds/rdma.c#L474) -> [set_page_dirty()](https://elixir.bootlin.com/linux/v4.14.13/source/mm/page-writeback.c#L2559) references `page->page_link`. Structures and function pointers are forged at address 0 to hijack the control flow.

#### 12. CVE-2019-9213 & CVE-2019-8956

[CVE-2019-9213-writeup](https://blog.csdn.net/panhewu9919/article/details/118557802)    [CVE-2019-8956-writeup](https://blog.csdn.net/panhewu9919/article/details/118557844)    

**Test version**: Linux-4.20.0 32-bit

**Protection**: SMEP enabled, SMAP/kaslr disabled.

**Vulnerability**: 

- CVE-2019-9213: The check of the minimum mmap address in [`expand_downwards()`](https://elixir.bootlin.com/linux/v4.20.7/source/mm/mmap.c#L2413) is wrong; it performs a capability check on the wrong task, bypassing the `mmap_min_addr` restriction. This is a **logic vulnerability**. By using the `LD_DEBUG=help /bin/su 1>&%d` command to perform a write operation, it should have checked the cred of the exploit, but instead it incorrectly checked the cred of the write process, thus marking the low address as privileged-accessible. Only 32-bit systems can successfully exploit this vulnerability; the reason is unknown.
- CVE-2019-8956: The [`sctp_sendmsg()`](https://elixir.bootlin.com/linux/v4.20.7/source/net/sctp/socket.c#L2025) function in `net/sctp/socket.c` has a **null-pointer dereference** vulnerability when handling the `SCTP_SENDALL` flag. Combined with CVE-2019-9213, it bypasses the `mmap_min_addr` restriction, allowing mmap to the low address 0xd4 to forge structures and hijack the control flow.

#### 13. CVE-2019-15666

[writeup](https://bsauce.github.io/2021/09/14/CVE-2019-15666/)  	  [reference](https://github.com/riskeco/Lucky/blob/master/lucky0_RE.c)

**Test version**: Ubuntu 18.04 (4.15.0-20-generic #21)

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: [verify_newpolicy_info()](https://elixir.bootlin.com/linux/v5.0.18/source/net/xfrm/xfrm_user.c#L1379) in `net/xfrm/xfrm_user.c` incorrectly handles the `dir` validation, leading to an **out-of-bounds access** in [__xfrm_policy_unlink()](https://elixir.bootlin.com/linux/v5.0.18/source/net/xfrm/xfrm_policy.c#L2202). The vulnerability is originally an out-of-bounds decrement by 1, but other paths can be used to construct a UAF, allowing an **8-byte null write on a free block**. The vulnerable object `xfrm_policy` resides in `kmalloc-1024`, and the cred structure resides in `kmalloc-192`. First, use `setxattr+userfaultfd` to spray `kmalloc-1024` heap blocks around `policy0`; after freeing `policy0`, also free the sprayed blocks, causing the slab to be reallocated as the cred of child process c after it is freed. Then trigger the UAF to perform an 8-byte null write on the free block to modify `gid/suid` in cred, and then add the current user to sudoers to escalate privileges.

#### 14. CVE-2020-8835

[writeup](https://www.cnblogs.com/bsauce/p/14123111.html)  	  [reference](https://xz.aliyun.com/t/7690)

**Test version**: Linux-5.5.0

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: `kernel/bpf/verifier.c` does not correctly convert a 64-bit value to 32-bit (it directly takes the lower 32 bits), resulting in **integer truncation**. This makes the BPF code verification phase inconsistent with the actual execution phase, leading to out-of-bounds read/write.

#### 15. CVE-2020-27194

[writeup](https://www.jianshu.com/p/b6f11d8df37a)       [reference](https://github.com/willinin/CVE-2020-27194-exp)

**Test version**: Linux-5.8.14

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: When performing an OR operation in the eBPF verifier, the `scalar32_min_max_or()` function assigns a 64-bit value to a 32-bit variable, causing **integer truncation**. This leads to incorrect calculation of the register range, thereby bypassing BPF checks and resulting in out-of-bounds read/write.

#### 16. CVE-2021-3156

[writeup](https://www.jianshu.com/p/18f36f1342b3)       [exploit](https://github.com/blasty/CVE-2021-3156)

**Test version**: Ubuntu 19.04, Sudo 1.8.27

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: When sudo processes command-line arguments, a logic error occurs when handling a command ending with a single backslash, leading to a **heap overflow**.

#### 17. CVE-2021-31440

[writeup](https://bsauce.github.io/2021/06/09/CVE-2021-31440/)      [exploit](https://github.com/bsauce/kernel-exploit-factory/tree/main/CVE-2021-31440/exp)

**Test version**: Linux-5.11

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: In the eBPF module, the [`__reg_combine_64_into_32()`](https://elixir.bootlin.com/linux/v5.11.20/source/kernel/bpf/verifier.c#L1312) function in `kernel/bpf/verifier.c` calculates registers incorrectly. The inconsistency between the verifier phase and the actual execution phase is exploited for out-of-bounds read/write. After leaking the kernel base, forging a function table, and achieving arbitrary read/write, the cred of the current thread is tampered with.

#### 18. CVE-2021-3490

[writeup](https://bsauce.github.io/2021/08/31/CVE-2021-3490/)      [exploit](https://github.com/chompie1337/Linux_LPE_eBPF_CVE-2021-3490)

**Test version**: Linux-5.11  Linux-5.11.16

**Protection**: SMEP/SMAP/kaslr enabled.

**Vulnerability**: In the eBPF module, the ALU32 boundary tracking for bitwise operations (AND, OR, and XOR) in `kernel/bpf/verifier.c` does not correctly update the 32-bit bounds, causing out-of-bounds read and write in the Linux kernel and thus leading to arbitrary code execution. The three vulnerable functions are [scalar32_min_max_and()](https://elixir.bootlin.com/linux/v5.13-rc3/source/kernel/bpf/verifier.c#L7078), [scalar32_min_max_or()](https://elixir.bootlin.com/linux/v5.13-rc3/source/kernel/bpf/verifier.c#L7149), and [scalar32_min_max_xor()](https://elixir.bootlin.com/linux/v5.13-rc3/source/kernel/bpf/verifier.c#L7219). The inconsistency between the verifier phase and the actual execution phase is exploited for out-of-bounds read/write. After leaking the kernel base, forging a function table, and achieving arbitrary read/write, the cred of the current thread is tampered with.

#### 19. CVE-2021-22555

[writeup](https://bsauce.github.io/2021/09/23/CVE-2021-22555/)      [exploit](https://github.com/google/security-research/blob/master/pocs/linux/cve-2021-22555/exploit.c)

**Test version**: Linux-5.11.14

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the `ip_tables` submodule of the Netfilter module in `net/netfilter/x_tables.c`, when `setsockopt()` is called with the option `IPT_SO_SET_REPLACE` (or `IP6T_SO_SET_REPLACE`), the kernel structure needs to be converted from 32-bit to 64-bit. Because the conversion size is incorrectly calculated, a **heap overflow writing zeros** occurs when calling the [xt_compat_match_from_user()](https://elixir.bootlin.com/linux/v5.11.14/source/net/netfilter/x_tables.c#L731) function, which can be turned into a UAF. Attackers can use it for privilege escalation or to escape from docker/k8s containers ([kubernetes](https://zhuanlan.zhihu.com/p/29232090)). It requires `CAP_NET_ADMIN` privileges, or support for `user+network` namespaces.

#### 20. CVE-2021-41073

[writeup](https://bsauce.github.io/2022/07/11/CVE-2021-41073/)      [reference](https://www.graplsecurity.com/post/iou-ring-exploiting-the-linux-kernel)

**Test version**: Linux-5.14.6

**Protection**: KASLR/SMEP/SMAP enabled. `CONFIG_SLAB_FREELIST_RANDOM` / `CONFIG_SLAB_FREELIST_HARDENED` / `CONFIG_BPF_JIT_ALWAYS_ON` / `CONFIG_MEMCG` disabled (the last one is enabled by default).

**Vulnerability**: The `loop_rw_iter()` function in `fs/io_uring.c` has a **type confusion** vulnerability. `io_kiocb->rw.addr` serves as both a kernel address and a user address, but when incremented in `loop_rw_iter()`, no distinction is made, causing the kernel address to be incorrectly incremented while reading a file, and finally incorrectly **freeing an adjacent buffer at a controllable offset** (kmalloc-32). The exploitation conditions are very strict: because the vulnerable object resides in kmalloc-32, the freelist protection mechanism is disabled; because the `seq_operations` object is allocated with the `GFP_KERNEL_ACCOUNT` flag, the `CONFIG_MEMCG*` mechanism is also disabled; this vulnerability achieves privilege escalation by tampering with the `sk_filter->prog` pointer in eBPF and forging a BPF program, so the `CONFIG_BPF_JIT_ALWAYS_ON` configuration is also disabled.

#### 21. CVE-2021-4154

[writeup](https://bsauce.github.io/2022/10/17/CVE-2021-4154/)      [reference](https://github.com/Markakd/DirtyCred)

**Test version**: Linux-5.13.3

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: The [cgroup1_parse_param()](https://elixir.bootlin.com/linux/v5.13.3/source/kernel/cgroup/cgroup-v1.c#L905) function in `kernel/cgroup/cgroup-v1.c` (triggered via the `fsconfig` system call) has a type confusion, leading to a **UAF vulnerability**. By calling the `fsconfig` syscall with an arbitrary fd, and finally closing that file, the corresponding `file` object is freed. This way, we can **free the `file` structure corresponding to any file descriptor**. This article uses two exploitation methods: one is DirtyCred, and the other is constructing a ROP chain. Comparing the two, the advantage of DirtyCred is that it works across kernel versions without adaptation; its disadvantage is that it requires overwriting a privileged file for privilege escalation, so it cannot escalate in containers such as docker. The advantage of ROP is that it can arbitrarily read/write kernel memory and execute arbitrary code; its disadvantage is that adapting it for different kernel versions is cumbersome.

#### 22. CVE-2021-42008

[writeup](https://bsauce.github.io/2021/12/09/CVE-2021-42008/)      [reference](https://syst3mfailure.io/sixpack-slab-out-of-bounds)

**Test version**: Linux-5.13.12

**Protection**: KASLR / SMEP / SMAP / PTI enabled.

**Vulnerability**: The [decode_data()](https://elixir.bootlin.com/linux/v5.13.12/source/drivers/net/hamradio/6pack.c#L826) function in `drivers/net/hamradio/6pack.c` has a **heap overflow**, and the user needs `CAP_NET_ADMIN` privileges. [sixpack_decode()](https://elixir.bootlin.com/linux/v5.13.12/source/drivers/net/hamradio/6pack.c#L962) can call [decode_data()](https://elixir.bootlin.com/linux/v5.13.12/source/drivers/net/hamradio/6pack.c#L826) multiple times to decode the input and save it to [sixpack->cooked_buf](https://elixir.bootlin.com/linux/v5.13.12/source/drivers/net/hamradio/6pack.c#L98). The `sixpack->rx_count_cooked` member serves as the index for accessing `sixpack->cooked_buf`, determining the target offset for writing the decoded bytes. The problem is that if `decode_data()` is called multiple times, `rx_count_cooked` keeps increasing until it exceeds the length of `cooked_buf` (400 bytes), resulting in an out-of-bounds write. Referring to [using the msg_msg structure in the Linux kernel to achieve arbitrary address read/write](https://www.anquanke.com/post/id/252558), one can construct an out-of-bounds read and arbitrary address write, then tamper with `modprobe_path` for privilege escalation. The downside is that it requires `userfaultfd` and cannot bypass the `CAP_NET_ADMIN` requirement.

#### 23. CVE-2021-43267

[writeup](https://bsauce.github.io/2021/12/06/CVE-2021-43267/)      [reference](https://haxx.in/posts/pwning-tipc/)

**Test version**: Linux-5.14.15

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: The vulnerability is located in `net/tipc/crypto.c`. In the TIPC (Transparent Inter-Process Communication) intra-cluster communication protocol, the length validation for `MSG_CRYPTO` type messages is incorrect, leading to a **heap overflow**. In the [tipc_crypto_key_rcv()](https://elixir.bootlin.com/linux/v5.14.15/source/net/tipc/crypto.c#L2281) function, the data portion of a TIPC message (the [tipc_msg](https://elixir.bootlin.com/linux/v5.14.15/source/net/tipc/msg.h#L148) structure) points to a `MSG_CRYPTO` message (the [tipc_aead_key](https://elixir.bootlin.com/linux/v5.14.15/source/include/uapi/linux/tipc.h#L241) structure). When allocating space for `tipc_aead_key` and copying `tipc_aead_key->key`, the validity of `tipc_aead_key->keylen` is not checked, resulting in an out-of-bounds copy. Only the `header size` and `msg size` of the TIPC message are checked, but the `tipc_aead_key->keylen` of the `MSG_CRYPTO` message is not checked. An `elastic object` is used to leak the kernel base, and `tty_struct->tty_operations.ioctl` is overwritten to point to an arbitrary-write gadget (`mov   QWORD PTR [rdx],rsi`), then `modprobe_path` is tampered with for privilege escalation.

#### 24. CVE-2022-0185

[writeup](https://bsauce.github.io/2022/04/08/CVE-2022-0185/)  

**Test version**: Linux-5.11.22

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: Privilege escalation was achieved on Google kCTF, winning $30,000. The `fs/fs_context.c` file in the kernel's File System Context module has an **integer overflow** that leads to a heap overflow. The attacker must have `CAP_SYS_ADMIN` privileges, or use namespaces or `unshare(CLONE_NEWNS|CLONE_NEWUSER)` (equivalent to the command `$ unshare -Urm`) to enter a namespace with `CAP_SYS_ADMIN` privileges. Two exploitation methods are used: one is to use **FUSE** (equivalent to userfault) to construct an arbitrary address write and modify `modprobe_path`; the other is to use `msg_msg` to construct an arbitrary free, then build a ROP chain for privilege escalation.

#### 25. CVE-2022-0847

[writeup](https://bsauce.github.io/2022/04/03/CVE-2022-0847/)      reference-[1](https://blog.csdn.net/Breeze_CAT/article/details/123393188) [2](https://www.anquanke.com/post/id/269886) [3](https://www.freebuf.com/vuls/324700.html)

**Test version**: Linux-5.16.10

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: **DirtyPipe vulnerability**. When the `splice` call links the page cache of a file to the pipe's ring buffer [pipe_buffer](https://elixir.bootlin.com/linux/v5.16.10/source/include/linux/pipe_fs_i.h#L26), neither [copy_page_to_iter_pipe()](https://elixir.bootlin.com/linux/v5.16.10/source/lib/iov_iter.c#L384) nor [push_pipe()](https://elixir.bootlin.com/linux/v5.16.10/source/lib/iov_iter.c#L547) initializes the `flag` member of [pipe_buffer](https://elixir.bootlin.com/linux/v5.16.10/source/include/linux/pipe_fs_i.h#L26) (an uninitialized variable vulnerability). Because the `PIPE_BUF_FLAG_CAN_MERGE` attribute is not cleared, the subsequent `pipe_write()` mistakenly believes the write operation can be merged, thereby writing illegal data into the file page cache (restored after reboot), resulting in an arbitrary file overwrite vulnerability. This vulnerability can write to the page cache of any file. The privilege escalation method is to modify the page cache of `/etc/passwd`; for a short time, all processes accessing that file will access the tampered file cache page.

#### 26. CVE-2022-0995

[writeup](https://bsauce.github.io/2022/04/15/CVE-2022-0995/)     

**Test version**: Linux-5.11.22

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: The `watch_queue` event notification subsystem has a **heap overflow**; the vulnerable function is [watch_queue_set_filter()](https://elixir.bootlin.com/linux/v5.16.14/source/kernel/watch_queue.c#L286). The kernel performs two validity checks on the user-supplied filter of type [watch_notification_type_filter](https://elixir.bootlin.com/linux/v5.16.14/source/include/uapi/linux/watch_queue.h#L52). The first check determines the allocated memory size, and the second stores the user filter into that memory. However, the two checks are inconsistent, resulting in the allocated space being too small and allowing more filters to be stored via overflow. The second overflow can be used to set specific bit positions in adjacent heap blocks. The subsequent exploitation method is the same as [CVE-2021-22555](https://bsauce.github.io/2021/09/23/CVE-2021-22555/).

#### 27. CVE-2022-1015

[writeup](https://bsauce.github.io/2022/07/16/CVE-2022-1015/)      [reference](https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/)

**Test version**: Linux-5.17

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the nftables module, the [nft_parse_register_load()](https://elixir.bootlin.com/linux/v5.17/source/net/netfilter/nf_tables_api.c#L9325) and [nft_parse_register_store()](https://elixir.bootlin.com/linux/v5.17/source/net/netfilter/nf_tables_api.c#L9377) functions do not restrict the range of the incoming register index, leading to an integer overflow (which can pass the range check), thereby triggering a **stack overflow with out-of-bounds read/write**. During exploitation, it is necessary to return from interrupt context to user mode, using the end of the `__do_softirq()` function to perfectly return to the syscall context, and then call `switch_task_namespaces(current, &init_nsproxy)` and `commit_cred(&init_cred)` for privilege escalation.

#### 28. CVE-2022-2588

[writeup](https://bsauce.github.io/2022/10/21/CVE-2022-2588/)      [reference](https://github.com/Markakd/CVE-2022-2588)

**Test version**: Linux-5.19.1

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: Similar to [CVE-2021-3715](https://access.redhat.com/security/cve/cve-2021-3715) (see [BlackHat 2021-Europe-Your Trash Kernel Bug, My Precious 0-day](https://zplin.me/talks/BHEU21_trash_kernel_bug.pdf), page 16), the check conditions for removing the `route4_filter` object from the linked list and freeing it are inconsistent, causing the object to remain in the list after being freed, which can later trigger a **double-free**. User namespaces are required to trigger it. The **DirtCred** method is used for privilege escalation.

#### 29. CVE-2022-2602

[writeup](https://bsauce.github.io/2022/06/08/CVE-2022-2602/)      [reference](https://1day.dev/notes/CVE-2022-2602-DirtyCred-File-Exploitation-applied-on-an-io_uring-UAF/)

**Test version**: Linux-5.18.19

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: The io_uring component has a feature `IORING_REGISTER_FILES` that can place files into the `sock->receive_queue` queue of io_uring. The Linux garbage collection mechanism GC (which only handles the flight count of io_uring and socket files) may free files registered in io_uring as garbage. The next time io_uring uses the file (via writev to write files, corresponding to the `IORING_OP_WRITEV` operation), a **UAF vulnerability** is triggered. Exploitation method: since the UNIX GC mechanism incorrectly frees the `file` structure still in use in `io_uring` (which is writing malicious data to the normal file `"/tmp/rwA"`), the **DirtyCred method** can be used to open a large number of `"/etc/passwd"` files to overwrite the just-freed `file` structure, so that eventually malicious data is actually written to `"/etc/passwd"`.

#### 30. CVE-2022-2639

[writeup](https://bsauce.github.io/2022/11/24/CVE-2022-2639/)      [reference](https://veritas501.github.io/2022_10_18-CVE-2022-2639%20%20openvswitch%20LPE%20%20%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/)

**Test version**: Linux-5.17.4

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the `openvswitch` kernel module, [reserve_sfa_size()](https://elixir.bootlin.com/linux/v5.17.4/source/net/openvswitch/flow_netlink.c#L2439) has an integer overflow that leads to a **kmalloc-0x10000 heap overflow write**, requiring page spraying to construct a cross-cache overflow. This article is based on the `pipe-primitive` to tamper with arbitrary files, so there is no need to bypass KASLR/SMEP/SMAP/KPTI protection mechanisms, and exploitation can be completed without adaptation across versions. **First, create a pipe and splice it to the read-only file `/usr/bin/mount`; heap spray to forge `pipe_buffer->flags = PIPE_BUF_FLAG_CAN_MERGE`, so that a suid-shell can be written to `/usr/bin/mount` and then executed for privilege escalation.**        The OOB is triggered twice: the first triggers the overflow to tamper with `msg_msg->m_ts` to out-of-bounds read the adjacent `msg_msg->m_list.next`, **leaking the kmalloc-1024 heap address**; the second triggers the overflow to tamper with `msg_msg->m_list.next` to point to the leaked kmalloc-1024 heap address, **constructing an arbitrary free**.

#### 31. CVE-2022-25636

[writeup](https://bsauce.github.io/2022/12/13/CVE-2022-25636/)      [reference](https://github.com/Bonfee/CVE-2022-25636)

**Test version**: Linux-5.13.19

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the `nf_table` module, the [nft_fwd_dup_netdev_offload()](https://elixir.bootlin.com/linux/v5.16.11/source/net/netfilter/nf_dup_netdev.c#L67) function in `net/netfilter/nf_dup_netdev.c` has an **OOB write** because the calculated allocation size is inconsistent with the condition checked during actual initialization (the system must support packet processing offloading on Network Interface Cards (NICs), which is rare in practice). **It overflow-writes the address of a `net_device` object (located in kmalloc-4k)**, and the size of the vulnerable object can vary (depending on the number of rules carrying the `NFT_OFFLOAD_F_ACTION` flag, it can be in `kmalloc-128` or `kmalloc-192`, etc.). `SYS_ADMIN` privileges are required. During exploitation, **the `net_device` kmalloc-4k heap pointer is leaked via `msg_msgseg`, an arbitrary free is constructed by overwriting the `msg_msg->security` pointer, the kernel base is leaked by reading `net_device->dev_addr` via the built-in `ioctl(fd, SIOCGIFHWADDR, leak)`, and privilege escalation is achieved by forging the `net_device->ethtool_ops->begin` function pointer to hijack the control flow**.

#### 32. CVE-2022-27666

[writeup](https://paper.seebug.org/1889/)      [reference](https://etenal.me/archives/1825)

**Test version**: Linux-5.16.14

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: At the PWN2OWN competition, privilege escalation was achieved on Ubuntu 21.10. In the kernel's esp6 crypto module, the receive buffer is 8 pages, but the sender can send data larger than 8 pages, causing a **page overflow** via the [null_skcipher_crypt()](https://elixir.bootlin.com/linux/v5.16.14/source/crypto/crypto_null.c#L76) function. The overall approach uses page spraying: first, the `user_key_payload` elastic object is used to leak `msg_msg->next`; then `msg_msg` is used to leak the `seq_operations->start` kernel address; finally, `msg_msg` combined with FUSE page fault handling is used to construct an arbitrary write, tampering with `modprobe_path` for privilege escalation.

#### 33. CVE-2022-32250[writeup](https://bsauce.github.io/2022/11/03/CVE-2022-32250/)      [reference](https://github.com/theori-io/CVE-2022-32250-exploit)

**Test version**: Linux-5.17.12

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the `nftables` module, when `net/netfilter/nf_tables_api.c` uses the `NFT_MSG_NEWSET` operation to add an `nft_set`, while processing the `lookup` and `dynset` expressions, a flawed `NFT_EXPR_STATEFUL` check causes the `nft_expr` object to remain in the `nft_set->binding` list after being freed, and adding a new `nft_expr` leads to a **UAF write** (triggering the vulnerability requires `CAP_NET_ADMIN` privileges). The UAF write writes the address value at offset 0x18 of another `kmalloc-64` heap chunk into offset 0x18 of a `kmalloc-64` chunk. The exploitation technique uses **`msg_msg` in mqueue to leak the kernel base**, because `posix_msg_tree_node->msg_list` in mqueue is at offset 0x18 (and resides in `kmalloc-64`), exactly matching the UAF write offset; in addition, **`posix_msg_tree_node->msg_list` can also be used to construct an Unlink exploit** to tamper with `modprobe_path`. Using `user_key_payload` to leak the heap address (for easier construction of the unlink) is a well-known technique. Note that libmnl or libnftnl versions above ubuntu21.04 must be used.

#### 34. CVE-2022-34918

[writeup](https://bsauce.github.io/2022/07/26/CVE-2022-34918/)      [reference](https://www.randorisec.fr/crack-linux-firewall/)

**Test version**: Linux-5.17.15

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the nftables module, the [nft_set_elem_init()](https://elixir.bootlin.com/linux/v5.18.10/source/net/netfilter/nf_tables_api.c#L5459) function has a **heap overflow**, with an overflow length of up to `64-16=48` bytes. The vulnerable object can reside in `kmalloc-{64,96,128,192}` (this article uses the kmalloc-64 vulnerable object). Exploitation — first construct the heap layout `vul_obj -> user_key_payload -> percpu_ref_data`, overflow to tamper `user_key_payload->datalen` to 0xffff, leaking the kernel base from `percpu_ref_data->release` and the physmap base from `percpu_ref_data->ref`; then construct the heap layout `vul_obj -> simple_xattr`, overflow to tamper the `simple_xattr->list` linked list, and use this constrained arbitrary write to change `modprobe_path` from `/sbin/modprobe` to `/tmp/xxxxprobe` for privilege escalation (the arbitrary write is triggered when the xattr is removed from the list). This arbitrary write requires leaking the physmap address; both `percpu_ref_data` and `shm_file_data` contain both the kernel base and the physmap address.

#### 35. CVE-2023-2598

[writeup](https://bsauce.github.io/2024/07/30/CVE-2023-2598/)      [reference](https://anatomic.rip/cve-2023-2598/)

**Test version**: Linux-6.3.1

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: An OOB write vulnerability in the io_uring module that can lead to **out-of-bounds read/write of physical memory**. The vulnerability is in the [io_sqe_buffer_register()](https://elixir.bootlin.com/linux/v6.3.1/source/io_uring/rsrc.c#L1230) function in `io_uring/rsrc.c`. When checking whether the submitted pages to be registered belong to the same compound page, it only checks whether the first pages of the compound pages are the same, without checking whether the submitted pages are actually the same page. This makes it possible to register the same physical page (impersonating a compound page made of multiple physical pages), constructing arbitrary-length out-of-bounds read/write on physical pages.   

Using the arbitrary-length out-of-bounds read/write of physical pages, it is possible to arbitrarily read/write the subsequent sock object. The kernel base is leaked via `sock->sk_data_ready`, the heap address of the sock object is leaked via `sock.sk_error_queue.next`, and control flow is **hijacked** by forging the `sock.__sk_common.skc_prot->ioctl` function pointer to point to [call_usermodehelper_exec()](https://elixir.bootlin.com/linux/v6.3.1/source/kernel/umh.c#L434). A forged `subprocess_info` structure is also required to complete the exploit, ultimately **executing `/bin/sh -c /bin/sh &>/dev/ttyS0 </dev/ttyS0` for privilege escalation**.

#### 36. CVE-2024-1086

[writeup](https://bsauce.github.io/2024/05/10/CVE-2024-1086/)      [reference](https://yanglingxi1993.github.io/dirty_pagetable/dirty_pagetable.html)

**Test version**: Linux-6.3.13

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: There is a **UAF vulnerability** in the nf_tables component of the netfilter subsystem. In the [nft_verdict_init()](https://elixir.bootlin.com/linux/v6.3.13/source/net/netfilter/nf_tables_api.c#L10321) function, a very large verdict value (malicious value 0xffff0000) is allowed; in the [nf_hook_slow()](https://elixir.bootlin.com/linux/v6.3.13/source/net/netfilter/core.c#L607) function, when handling `NF_DROP` (0), it first frees the skb packet and calls [NF_DROP_GETERR()](https://elixir.bootlin.com/linux/v6.3.13/source/include/linux/netfilter.h#L19) to modify the return value (setting it to `NF_ACCEPT` - a positive value 1, based on the verdict). The subsequent reference to the skb triggers the UAF, and [NF_HOOK()](https://elixir.bootlin.com/linux/v6.3.13/source/include/linux/netfilter.h#L407) frees the skb again. Exploitation method: **construct overlapping PMD pages and PTE pages**, where `PMD[0]`/`PMD[1]` overwrite `PTE[0]`/`PTE[1]`. By writing to the user virtual address corresponding to the PTE page, a PTE page for `PMD[0]` is forged (the entries correspond to physical addresses), so that by writing to the user virtual address corresponding to the PMD, **arbitrary physical address write** is achieved.

#### 37. CVE-2025-21702

[writeup](https://bsauce.github.io/2026/01/27/CVE-2025-21702/)      [reference](https://github.com/quanggle97/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-21702_lts_cos)

**Test version**: Linux-6.6.75

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: In the `net/sched` module, when the `pfifo_tail_enqueue()` function is called on a qdisc scheduler (with its `sch->limit == 0`), the qdisc queue length qlen is incorrectly increased (even though the queue is full, a new packet is added without first dropping one), while the qlen of the parent qdisc (the caller) is not increased, making the parent queue's qlen unequal to the sum of its child queues' qlens, which can be used to construct a UAF. Leaking the kernel base — tamper with `user_key_payload->datalen` using the red-black tree node insertion principle to construct an out-of-bounds read, leaking the `xfrm_policy_timer` function pointer in an adjacent `xfrm_policy` object. Hijacking control flow — forge the `UAF_hfsc_class->dequeue` function pointer; after packet enqueue, the subsequent dequeue triggers `hfsc_dequeue()` -> `qdisc_dequeue_peeked()` -> `sch->dequeue()` to hijack control flow, with the RDI register controllable.

#### 38. CVE-2026-23271

[writeup](https://bsauce.github.io/2026/05/29/CVE-2026-23271/)      [reference](https://github.com/simond67/security-research/tree/Add-kernelCTF-CVE-2026-23271_lts/pocs/linux/kernelctf/CVE-2026-23271_lts)

**Test version**: Linux-6.12.24

**Protection**: KASLR/SMEP/SMAP enabled.

**Vulnerability**: There is a race condition UAF vulnerability in `kernel/events/` (perf subsystem). There is a race condition between `__perf_event_overflow()` and `perf_remove_from_context()`. For software/tracepoint-driven perf events, overflow handling only disables preemption (without disabling hard interrupts). In this context, the cleanup path of `perf_event_release_kernel()` → `perf_remove_from_context()` can run concurrently on another CPU, freeing callback-related event state (e.g. `event->pending_task`) while the overflow path is still using it, leading to UAF. The fix is to add proper synchronization in `__perf_event_overflow()` to ensure the free path cannot proceed concurrently while the overflow path accesses callback-related fields.
- The race (a Worker thread triggers the tracepoint overflow path, while a Closer thread concurrently calls `close()` on the perf_event fd) triggers `WARN_ON_ONCE`; after the refcount reaches zero, `task_work_add` still adds the freed event's `pending_task` to the task_work list.
- Poll `/proc/sys/kernel/tainted` for the TAINT_WARN bit (512) to detect a successful race; 1024 spray threads free synchronously, using event B to occupy the slab slot freed by event A.
- When futex_wait returns to userspace, `perf_pending_task` executes `put_event(event B)`, incorrectly reducing event B's refcount to 0, forming a **stable dangling FD**.
- The ID Oracle allocates event C one by one to probe ID changes, precisely locating the victim; the cross-cache attack returns the `perf_event_cache` slab page to buddy and then reclaims it with `msg_msgseg`.