Loading story…
Researchers documented how a Linux kernel networking flaw fixed by commit 36eec020fab66—a NULL pointer dereference in mq_attach—can be turned from a crash into local root access under the right conditions. The walkthroughs used Debian 12 with vulnerable kernel 6.1.8-1, showed the bug being triggered by creating a bond interface, attaching an mq queuing discipline, and replacing that qdisc, and then demonstrated how the fault path could be steered into a refcount underflow and controlled callback execution. The lab setup deliberately weakened protections by allowing NULL-page mapping and disabling mitigations such as SMEP, SMAP, KASLR, and PTI to study exploitability in a controlled environment.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
When KASLR was enabled, hard-coded gadget and symbol addresses no longer worked, so the exploit was adapted to leak the randomized address of noop_qdisc from a controlled netdev_queue during qdisc replacement. The leaked address was used to compute the KASLR slide, rebuild gadget addresses, and trigger the vulnerability again to regain root.
In the fourth Allele Security post, enabling SMEP broke the earlier ret2usr privilege-escalation method, so the exploit was reworked to use a kernel ROP chain with a stack pivot, prepare_kernel_cred, commit_creds, rtnl_unlock, and a swapgs/sysretq return path. With SMEP enabled and KASLR disabled, the revised exploit successfully regained root privileges.
By aligning a userland stand-in struct Qdisc so refcnt sat at offset 0x64 and setting myqdisc at address 0x28, the researcher drove execution into qdisc_destroy. Kernel logs then showed an NX-protected page execution attempt, and GDB indicated ((struct Qdisc *)0x28)->ops->destroy resolved to 0x28.
After mapping the NULL page and placing crafted data there, the observed kernel behavior changed from a not-present page fault to a refcount underflow/use-after-free warning in mq_attach and qdisc_put. This demonstrated attacker influence over the dereferenced object layout during exploitation.
The researcher then implemented the trigger in C using unshare(CLONE_NEWNET | CLONE_NEWUSER) and libnl NETLINK_ROUTE operations to create the bond interface and manipulate qdiscs programmatically. Running the trigger again caused the process to be killed and produced a kernel call trace through qdisc_graft and tc_modify_qdisc.
The second Allele Security post shows that creating a bond interface, bringing it up, adding an mq qdisc, and replacing that qdisc inside unprivileged user and network namespaces reliably triggers the bug. Kernel logs reported a NULL pointer dereference at address 0x0 after the sequence executed.
The first Allele Security post sets up a Debian 12 lab using Debian kernel package version 6.1.8-1, matching source, debug symbols, and a boot configuration that disables SMEP, SMAP, KASLR, and PTI while setting vm.mmap_min_addr=0. The environment is prepared specifically to study and exploit the mq_attach NULL pointer dereference.
The Allele Security articles identify Linux kernel commit 36eec020fab66, titled "net: sched: fix NULL pointer dereference in mq_attach," as the fix for the targeted networking vulnerability. This establishes the upstream remediation event for the bug later analyzed and exploited in the lab series.
The namespaces manual states that since Linux 3.8, creating a user namespace no longer requires privilege. This capability is relevant to later exploitation techniques that rely on unprivileged user and network namespaces.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
man7.org
Open sourceallelesecurity.com
Open sourceallelesecurity.com
Open sourceallelesecurity.com
Open sourceallelesecurity.com
Open sourceoutflux.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026
A flaw in the Linux kernel CAN networking receive path, tracked as **CVE-2023-2166**, can allow a local low-privileged user to crash an affected system. The defect occurs when `can_rcv_filter` handles received CAN frames and dereferences the CAN-specific `ml_priv` pointer without confirming it was initialized, resulting in a NULL-pointer dereference and denial of service. The condition can arise because bonding or TUN network devices may report the CAN hardware type (`ARPHRD_CAN`) without initializing `ml_priv`; the issue was reported by syzbot and Wei Chen and fixed upstream by adding the required initialization check. Red Hat rates the issue **CVSS 5.5 (Moderate)**, with availability impact only, and released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems in errata including **RHSA-2024:0461**, **RHSA-2024:0881**, and **RHSA-2024:0897**.
Aug 26, 2026
XBOW reported finding and exploiting `CVE-2026-72018`, a high-severity out-of-bounds write in Linux’s DIBS loopback implementation for the SMC-D shared-memory communications path. A missing bounds check during a driver copy operation lets peer-controlled CLC handshake data trigger a constrained 16-byte zero write at a partly controlled kernel-memory address; XBOW developed this seemingly limited primitive into local root access by zeroing security-relevant fields in the kernel `cred` structure, including the effective UID. The demonstrated exploit requires `CAP_NET_ADMIN` to enable SMC-D and manipulate handshake traffic through an NFQUEUE-based man-in-the-middle setup, limiting exposure to attackers with substantial local privileges. The finding, which human reviewers had missed, highlights the growing role of AI-assisted vulnerability research while retaining human judgment in the exploitation process. Upstream fixes now validate the offset and copy size before the vulnerable operation; administrators should apply the relevant kernel updates, reboot affected hosts, and review assignments of `CAP_NET_ADMIN`.
Sep 30, 2026