CVE-2026-3600

This repository is a minimal local Linux privilege-escalation exploit consisting of one Bash script (`CVE-2026-3600.sh`) and a placeholder README. The script is not a scanner or detector; it actively attempts exploitation. Its purpose is to gain host root privileges from an unprivileged local account by abusing a cgroup v1 `release_agent` escape path from within a newly created user and network namespace. Operational flow: the script first verifies it is not already running as root and checks for required binaries (`unshare`, `mount`, `rmdir`, `ip`). It then creates a temporary shell payload under `/tmp/fragnesia.XXXXXX.sh`. That payload copies `/bin/bash` to `/tmp/.rootshell` and marks it setuid (`chmod 4755`), effectively creating a reusable root backdoor. Next, the exploit enters a new user+network namespace with `unshare --user --map-root-user --net bash`, brings up loopback, and attempts to mount a cgroup v1 memory controller at `/tmp/cg_escape`. It writes the payload path into `/tmp/cg_escape/release_agent`, creates a child cgroup, places the current process into it via `cgroup.procs`, enables `notify_on_release`, and removes the child cgroup to trigger the release handler. If successful, the host executes the payload as root and drops `/tmp/.rootshell`. The script then checks for that file and instructs the operator to run `/tmp/.rootshell -p` on the host. There are no network callbacks, remote C2 endpoints, or external downloads. All observables are local filesystem paths and namespace/cgroup interactions. The exploit is operational because it includes a working payload and exploitation logic, but it is not heavily modular or framework-based.