Loading vulnerability…
CVE-2025-40271 is a use-after-free in the Linux kernel procfs directory-iteration path, specifically proc_readdir_de(). When a proc_dir_entry is removed from its parent subdirectory red-black tree using rb_erase(), its tree-node state was not cleared. During a concurrent directory traversal, proc_readdir_de() releases and later reacquires proc_subdir_lock before calling pde_subdir_next(). That function can consequently derive and return a stale pointer to an entry that was removed and released, causing subsequent access to freed kernel memory. The upstream fix clears the erased red-black-tree node with RB_CLEAR_NODE(), causing pde_subdir_next() to return NULL rather than a freed entry.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a README plus two exploit implementations: a native C PoC (exploit.c) and a no-compile Bash wrapper with embedded Python (exploit.sh). Both target CVE-2025-40271, a local Linux kernel use-after-free in proc_readdir_de()/remove_proc_entry() within procfs. The exploit flow is: verify kernel version is likely vulnerable, create a new user and network namespace to gain CAP_NET_ADMIN inside the namespace, create multiple veth pairs so entries appear under /proc/self/net/dev_snmp6, race getdents64-based directory enumeration against rapid veth deletion, spray System V message objects to reclaim freed memory, and detect success when d_ino looks like a kernel pointer. The C version uses netlink route sockets and pthreads; the shell version re-execs itself under unshare -Ur --map-root-user --net and uses embedded Python with ctypes/syscall wrappers for getdents64 and SysV message queue spraying. The exploit is clearly local, not network-delivered. It is more than a detector because it actively performs namespace setup, interface churn, heap spraying, and leak extraction. However, the included privilege-escalation stage is only partially generic: it prepares a modprobe-style payload (/tmp/pwn and /tmp/trigger) to create /tmp/rootsh as a SUID shell, but both README and code state that a full overwrite of modprobe_path requires target-specific kernel offsets/KASLR knowledge. As a result, the repository is best characterized as an operational PoC demonstrating UAF + heap leak with partial LPE scaffolding rather than a universally reliable full root exploit.
Repository contains two C programs and two Markdown documents describing a local privilege escalation exploit for CVE-2025-40271, a claimed Linux kernel use-after-free in fs/proc/proc_readdir_de(). The code is not part of a known exploit framework. Exploitbasic.c is a verbose proof-of-concept style implementation: it creates user and network namespaces with unshare(), performs heap spraying using System V message queues (msg_msg objects sized to land in kmalloc-192), references veth interface churn as the UAF trigger, simulates a leaked kernel pointer from /proc/self/net/dev_snmp6, derives a kernel base, and if already root launches /bin/sh. Exploit.c is a more compact/stealth-oriented variant using direct syscalls, XOR-obfuscated strings, silent execution, and a hardcoded task_struct cred offset (0xad8) to zero credential fields before execve('/bin/bash'). Main exploit capability is local kernel LPE, not remote exploitation. No network C2 or external callback infrastructure is present; the only notable endpoints are local filesystem/procfs paths and shell binaries. The Markdown files provide vulnerability background, patch references, exploitation narrative, and operational/anti-forensic discussion. Overall, the repository’s purpose is to demonstrate and describe a Linux kernel UAF-to-root workflow using namespace setup, heap grooming, pointer leak/KASLR bypass concepts, and credential overwrite to obtain a root shell.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel use-after-free vulnerability in proc_readdir_de() that can lead to privilege escalation or denial of service.
A Linux kernel use-after-free vulnerability in proc_readdir_de() that can lead to privilege escalation or denial of service.
A Linux kernel use-after-free vulnerability in proc_readdir_de() that can lead to privilege escalation or denial of service.
A Linux kernel use-after-free vulnerability in proc_readdir_de() that can lead to privilege escalation or denial of service.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.