guard-wait/cve-2026-64563_expUnverified Linux kernel privilege-escalation PoC using msg_msgseg cross-cache reuse to overlap skb and pipe_buffer, altering pipe flags to read /etc/passwd.
For experimental research only. The code for prefetch and nperm (the memory reference set.gdb needs to be configured) is not attached, and since it has not been optimized, the hit probability is low.
The author noticed that the vulnerability author has already released relevant information about this vulnerability: https://github.com/google/security-research/pull/414
The exploitation approach is completely different. Since this approach has not been fully verified, a conservative opinion is held (mainly, whether the sock spinlock can actually be raced was not tested by the author; based on a partial understanding of the code, the race can be triggered via the timerfd hard interrupt).
Preliminary analysis: https://xz.aliyun.com/news/92649
Exploitation approach: msg_msgseg reuses tipc_sock through cross_cache, forges some fields to pass all checks and eventually frees it. Then an overlap between skb and pipe_buffer is constructed, and the flags of pipe_buffer are tampered with (splice the read-only file /etc/passwd and then tamper with the flags — an extended exploitation approach of Dirty Pipe). Since the kernel heap address is not leaked, the forged sk->lock.wq cannot point to itself. To pass the check, curr->func (see the __wake_up_common call chain in the source code for details) is forged as ret, so the data-only implementation is not particularly complete.
