Loading vulnerability…
CVE-2025-21756 is a use-after-free in the Linux kernel's AF_VSOCK socket binding lifecycle. A newly created vsock is placed on the unbound-socket list with an associated reference. During transport reassignment, the transport release path can remove the socket as though it were bound, without confirming that it has moved to the bound list. A subsequent bind operation assumes the socket remains on the unbound list and removes it again, dropping the socket reference count to zero while the bind path continues to access it. The fix preserves explicit and implicit (autobind) bindings until socket destruction, preventing premature unbinding and reference-count underflow.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a comprehensive exploit toolkit for CVE-2025-21756, a use-after-free (UAF) vulnerability in the Linux kernel's vsock subsystem. The exploit is designed for local privilege escalation and is operational, providing a working payload that spawns a root shell or executes arbitrary commands as root. The repository is structured with multiple C source files, including several variants and backup versions of the exploit, as well as supporting scripts for building, running, and debugging the exploit in a QEMU virtualized environment. Key files include: - `exploit.c`: The main exploit, which performs heap manipulation and ROP chain construction to escalate privileges. It includes a modprobe-based payload for code execution. - `test.c`, `trigger.c`, `trigger2.c`: Variants and helpers for triggering the UAF and testing different exploitation strategies. - `theori/exploit.c` and `theori/modules/`: An alternative exploit implementation with modularized heap spraying and kernel object manipulation utilities. - Supporting scripts (`compile.sh`, `run.sh`, `local_runner.sh`, etc.) automate building and running the exploit in a controlled environment. The exploit works by manipulating vsock sockets to trigger a UAF, then performing heap spraying (using pipes, UNIX sockets, xattrs, keyrings, etc.) to control freed memory and execute a ROP chain in the kernel. The payload typically calls `commit_creds(init_cred)` to gain root, then spawns a shell or overwrites `/proc/sys/kernel/core_pattern` to execute arbitrary code via modprobe. The exploit is highly configurable and includes utilities for KASLR bypass and kernel address discovery. Fingerprintable endpoints include several file paths used for payload delivery and privilege escalation, such as `/proc/sys/kernel/core_pattern`, `/tmp/evil`, `/tmp/trigger`, and `/proc/1/ns/*` for namespace manipulation. The attack vector is local, requiring the attacker to execute code on the target system. Overall, this repository demonstrates a mature, operational exploit for a modern Linux kernel vulnerability, with extensive support for debugging, testing, and adapting the exploit to different environments.
This repository contains a full exploit environment for CVE-2025-21756, a use-after-free vulnerability in the Linux kernel vsock subsystem. The main exploit logic is implemented in 'x.c', which orchestrates a series of vsock socket operations to trigger the vulnerability, leak kernel addresses, and construct a ROP chain to escalate privileges to root. The payload ultimately spawns a root shell. The repository includes scripts for compiling the exploit ('compress.sh'), extracting kernel images ('extract-image.sh'), and running the exploit in a QEMU virtual machine ('run.sh'). The initramfs directory provides a minimal root filesystem with busybox and necessary symlinks for the QEMU environment. The exploit is operational and targets Linux kernel 6.6.75, requiring vsock support and a controlled VM environment. No network endpoints are directly targeted; the attack vector is local privilege escalation via kernel exploitation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific Linux privilege-escalation vulnerability (kernel exploit) referenced as an operator-downloadable exploit binary used by the ShadowHS post-exploitation framework to elevate privileges on compromised hosts.
Linux kernel vsock vulnerability involving premature release of a socket binding before socket destruction.
A vulnerability referenced as a trending CVE affecting the Linux kernel (no technical details provided in the content).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.