CVE-2025-40271 — proc_readdir_de() rb-tree UAF LPE

Proof-of-concept for a local privilege escalation vulnerability in the Linux kernel proc filesystem. The bug is a use-after-free in proc_readdir_de() caused by rb_erase() without RB_CLEAR_NODE(), leaving stale red-black tree links that can be raced during directory enumeration.

Author: MadExploits

Original vulnerability research and C PoC by Aviral Srivastava (N-DAY RESEARCH). This repository includes a shell port (exploit.sh) for environments where compilation is not practical.

Overview

Root cause

When a proc directory entry is removed, rb_erase() is called on the entry's rb-node without RB_CLEAR_NODE(). Freed nodes can remain reachable via stale tree links. If getdents64() races with interface removal under /proc/self/net/dev_snmp6/, the kernel may read freed memory — often reclaimed by sprayed msg_msg objects — and return anomalous d_ino values that leak kernel heap pointers.

Affected & patched kernels

The PoC checks the running kernel version and exits on patched builds:

Repository contents

Both implementations follow the same exploitation flow:

1. Enter user + network namespace (gain CAP_NET_ADMIN in net ns)
2. Create veth pairs → populate /proc/self/net/dev_snmp6/
3. Race getdents64() against rapid veth deletion + heap spray
4. Detect UAF via kernel-pointer-like d_ino values
5. Attempt escalation (full LPE requires kernel-specific KASLR offsets)

Requirements

Common

• Linux x86_64
• Unprivileged user namespaces enabled:
  root@kitploit:~

  cat /proc/sys/kernel/unprivileged_userns_clone
  # must be 1
  

• Non-root user (PoC exits if already root)

exploit.c

• gcc with pthreads
• Linux headers (linux/netlink.h, etc.)

gcc -o exploit exploit.c -lpthread

exploit.sh

• bash
• python3
• ip (iproute2)
• unshare (util-linux with --map-root-user support)

No compiler required.

Usage

Shell version (recommended for quick testing)

chmod +x exploit.sh
./exploit.sh

C version

gcc -o exploit exploit.c -lpthread
./exploit

Expected output

Vulnerable kernel — UAF triggered (partial success):

[+] Kernel X.Y.Z — VULNERABLE
[+] Namespace ready...
[+] Created 32 veth pairs (/proc/self/net/dev_snmp6 populated)
[+] UAF HIT! d_ino=0xffff8880........ (kernel heap pointer)
[+] Kernel heap leak: 0xffff8880........
[*] PARTIAL SUCCESS: UAF + heap leak DEMONSTRATED

Patched kernel:

[-] Kernel X.Y.Z — PATCHED
[*] Kernel is patched. Nothing to do.

Exploitation notes

• Heap leak: When the race wins, d_ino contains a value matching the x86_64 kernel pointer pattern (0xffff000000000000), typically from msg_msg header m_list overlapping freed proc_dir_entry data.
• Full LPE: Overwriting modprobe_path requires the offset between the leaked heap address and kernel text base — this is build-specific (KASLR). The PoC demonstrates the UAF and leak; a complete chain needs offsets for your target kernel image.
• Reliability: Success depends on scheduler timing. The PoC retries up to 30 race attempts by default.

Mitigation

• Upgrade to a patched kernel (see table above).
• If user namespaces are not required, disable unprivileged creation:
  root@kitploit:~

  sysctl -w kernel.unprivileged_userns_clone=0
  

• Apply vendor security updates for CVE-2025-40271.

Disclaimer

This project is provided for authorized security research, education, and defensive testing only.

• Only run against systems you own or have explicit written permission to test.
• Unauthorized use against third-party systems may violate applicable laws.
• The authors and contributors are not responsible for misuse of this code.

Credits

License

Use at your own risk. No warranty is provided.