Loading vulnerability…
CVE-2025-40271 is a use-after-free vulnerability in the Linux kernel proc filesystem function proc_readdir_de(). Removing a proc directory entry from a subdirectory red-black tree with rb_erase() does not clear the removed node's state. During concurrent directory enumeration and network-device unregistration, pde_subdir_next() can consequently follow a stale tree link and return a proc_dir_entry that has already been released to the slab allocator. The race occurs while proc_subdir_lock is released and subsequently reacquired during enumeration. The issue was reproduced using simultaneous stress-ng getdent and tun tests and can potentially lead to privilege escalation or denial of service.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a README plus two exploit implementations: a native C PoC (exploit.c) and a no-compile Bash wrapper with embedded Python (exploit.sh). Both target CVE-2025-40271, a local Linux kernel use-after-free in proc_readdir_de()/remove_proc_entry() within procfs. The exploit flow is: verify kernel version is likely vulnerable, create a new user and network namespace to gain CAP_NET_ADMIN inside the namespace, create multiple veth pairs so entries appear under /proc/self/net/dev_snmp6, race getdents64-based directory enumeration against rapid veth deletion, spray System V message objects to reclaim freed memory, and detect success when d_ino looks like a kernel pointer. The C version uses netlink route sockets and pthreads; the shell version re-execs itself under unshare -Ur --map-root-user --net and uses embedded Python with ctypes/syscall wrappers for getdents64 and SysV message queue spraying. The exploit is clearly local, not network-delivered. It is more than a detector because it actively performs namespace setup, interface churn, heap spraying, and leak extraction. However, the included privilege-escalation stage is only partially generic: it prepares a modprobe-style payload (/tmp/pwn and /tmp/trigger) to create /tmp/rootsh as a SUID shell, but both README and code state that a full overwrite of modprobe_path requires target-specific kernel offsets/KASLR knowledge. As a result, the repository is best characterized as an operational PoC demonstrating UAF + heap leak with partial LPE scaffolding rather than a universally reliable full root exploit.
Repository contains two C programs and two Markdown documents describing a local privilege escalation exploit for CVE-2025-40271, a claimed Linux kernel use-after-free in fs/proc/proc_readdir_de(). The code is not part of a known exploit framework. Exploitbasic.c is a verbose proof-of-concept style implementation: it creates user and network namespaces with unshare(), performs heap spraying using System V message queues (msg_msg objects sized to land in kmalloc-192), references veth interface churn as the UAF trigger, simulates a leaked kernel pointer from /proc/self/net/dev_snmp6, derives a kernel base, and if already root launches /bin/sh. Exploit.c is a more compact/stealth-oriented variant using direct syscalls, XOR-obfuscated strings, silent execution, and a hardcoded task_struct cred offset (0xad8) to zero credential fields before execve('/bin/bash'). Main exploit capability is local kernel LPE, not remote exploitation. No network C2 or external callback infrastructure is present; the only notable endpoints are local filesystem/procfs paths and shell binaries. The Markdown files provide vulnerability background, patch references, exploitation narrative, and operational/anti-forensic discussion. Overall, the repository’s purpose is to demonstrate and describe a Linux kernel UAF-to-root workflow using namespace setup, heap grooming, pointer leak/KASLR bypass concepts, and credential overwrite to obtain a root shell.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in the Linux kernel proc_readdir_de() function that can cause privilege escalation or denial of service. Affected Rocky Linux 10.1 kernel packages have security updates under CIQ advisory crlsa-2026_1690.
A Linux kernel use-after-free vulnerability in proc_readdir_de() can occur when traversal of /proc/pid/net/dev_snmp6/ races with network-device removal. Erased red-black tree nodes are not marked empty, allowing pde_subdir_next() to return a freed entry. The fix uses RB_CLEAR_NODE() to prevent access to the freed entry. The reference assigns a CVSS v3 base score of 7.8, with local access and low privileges required, and reports exploit availability.
Vulnerability referenced by the advisory; no individual description is provided.
A vulnerability included in the CentOS 7 TuxCare security advisory/plugin.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.