Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-writeups-and-pocs — CVE-2026-80724 PoC + full write-up — Linux kernel ptp/vmclock read-only mapping becomes writable (VM_MAYWRITE). Discovered, reported & fixed by Abdifatah Suruur (suruurism) | Kitploit
Tools/GitHubGitHub/suruurism/cve-writeups-and-pocs
Vulnerability AnalysisExploitationPapers & ResearchLearning & EducationBinary Exploitation
GitHubsuruurism/cve-writeups-and-pocs

cve-writeups-and-pocs

CVE-2026-80724 PoC + full write-up — Linux kernel ptp/vmclock read-only mapping becomes writable (VM_MAYWRITE). Discovered, reported & fixed by Abdifatah Suruur (suruurism)

View Repository
14011 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE Write-ups & PoCs

Security research by Abdifatah Suruur (suruur / suruurism) — a collection of CVE write-ups and proof-of-concepts for Linux kernel vulnerabilities discovered independently.

CVE Index

CVEComponentCVSSStatus
CVE-2026-80926Linux kernel ksmbd — use-after-free in oplock break notification9.8 CriticalFixed in v7.3-rc2; backported to 7.2.5, 6.18.51, 6.12.111 and 6.6.158
CVE-2026-80724Linux kernel ptp/vmclock — read-only mappings become writable8.8 HighFixed in v7.3-rc1; backported to 6.18.47, 7.1.11 and 7.2.1

CVE-2026-80724 - PoC & Write-up

Linux kernel ptp: vmclock: prevent read-only mappings from becoming writable

Full Proof-of-Concept + Technical Write-up

  • CVE ID: CVE-2026-80724
  • Severity: 8.8 (High) — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  • Component: Linux kernel drivers/ptp/ptp_vmclock.c
  • Discovered & Fixed by: Abdifatah Suruur (@suruurism)
  • Status: Publicly disclosed • Patch merged • Stable backports available

Quick Start – Run the PoC

git clone https://github.com/suruurism/cve-writeups-and-pocs.git
cd cve-writeups-and-pocs/CVE-2026-80724
make
sudo ./vmclock_poc /dev/vmclock0
Exit CodeMeaning
0WRITE LANDED → system is vulnerable
1mprotect refused or write faulted → patched
2No vmclock device found

Vulnerability Summary

The ptp_vmclock driver correctly rejects writable mappings of the shared vmclock ABI page with -EROFS, but leaves VM_MAYWRITE set.

A process that can open /dev/vmclockN can:

  1. mmap() the page as PROT_READ
  2. Upgrade it with mprotect(PROT_READ|PROT_WRITE)
  3. Write into the host-owned timekeeping data (sequence counter, UTC time, TSC offset, disruption marker)

This breaks the fundamental read-only contract of the vmclock ABI.

CVE-2026-80724 — Contents

PathDescription
CVE-2026-80724/CVE-2026-80724.mdFull technical write-up (root cause, impact, timeline, references)
CVE-2026-80724/vmclock_poc.cWorking Proof-of-Concept
CVE-2026-80724/MakefileSimple build file

Official References

  • CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-80724
  • Fix commit: https://git.kernel.org/torvalds/c/a5edadbae57e2298a56cf7a4e774a027905a331f
  • Patch submission: 20260813174707.14809-1
  • Linux CVE announce: https://lists.openwall.net/linux-cve-announce/2026/08/28/126

Author

Abdifatah Suruur (suruur / suruurism)

  • GitHub: @suruurism

Disclaimer

This repository is for educational and research purposes only.

Use the PoC only on systems you own or have explicit permission to test.

Download Tool