Use-after-free in Linux kernel eventpoll ep_free()

This repository is a mixed research-and-code disclosure for Android kernel exploitation centered on CVE-2026-43499 and CVE-2026-43074. It is not just documentation: it contains buildable reference exploit source trees under examples/ for multiple Android kernel/KMI tracks, plus analysis helpers and extensive methodology docs. The overall structure is: top-level documentation and case matrices; public methodology and workflow docs under docs/public/; and per-target reference implementations under examples/. The code most clearly shows local privilege-escalation exploit chains for Android devices, especially the verified 5.15 and 6.1 reference trees. Main exploit capabilities observed in code: (1) local kernel exploitation using futex/PI requeue, pselect, ashmem/configfs/file_operations manipulation, and pipe-based primitives; (2) KASLR leakage via crafted kernel interactions and, in some cases, /proc/kallsyms-assisted fallback; (3) establishment of kernel arbitrary/physical read-write style primitives (physrw) with explicit readback verification; (4) credential and SELinux manipulation to obtain uid 0 / permissive state; (5) post-exploitation persistence/interaction via an embedded su daemon listening on a UNIX socket; and (6) carrier/service-based privilege closure using Android services such as dumpstate/bugreportd and carrier libraries. The 5.15 tree also includes a separate epoll43074 path and payload assembly for CVE-2026-43074-related experimentation. Repository maturity is best described as OPERATIONAL rather than framework-grade weaponized. Payloads are included and functional, but they are tightly bound to exact target kernels, target headers, and vendor/service assumptions. The repository repeatedly emphasizes exact-image binding, evidence labels, and non-portability of offsets and runtime geometry. Notable code layout: examples/pd2241-5.15-reference/source/verified/ and examples/pd2324-6.1-reference/source/verified/ contain the main exploit implementations. Core files include main.c (thread orchestration and exploit flow), slide.c (kernel base/KASLR leak), fops.c (fake fops / configfs / bridge logic), pipe.c (pipe-based physrw primitive), root.c (credential and SELinux manipulation plus proof generation), preload.c (constructor entrypoint and post-exploitation file/service setup), and su_daemon.c (root shell daemon/client over AF_UNIX). Supporting Python scripts verify offsets, analyze vendor modules such as vr.ko, and validate symbol contracts. The repository is therefore a real exploit/reference-source repository, not merely a detector. It contains both exploit logic and post-exploitation payload behavior, but it is intentionally organized as research-grade, exact-target reference implementations rather than turnkey mass exploitation tooling.

This repository is a local Linux kernel privilege-escalation exploit for CVE-2026-43074, centered on a race/use-after-free style corruption path involving eventpoll objects and pipe buffers. The main exploit is 'exploit.c', which uses heavy epoll spraying, victim slab shaping, multithreaded racing, CPU pinning, and pipe spraying to reclaim corrupted kernel objects. Its success condition is not a crash or info leak but a Dirty-Pipe-like post-corruption primitive against '/etc/passwd': it reopens the file and checks whether the first line starts with 'root::0', indicating the root password field was cleared. On success it executes '/bin/su root' to yield a root shell. Repository structure supports full repro and debugging rather than just a standalone exploit binary. 'compile.sh' builds the exploit with debug-friendly flags. 'build.sh' clones the Ubuntu Noble kernel tree from Launchpad, applies 'noble.patch', and enables a large set of debug/QEMU-friendly kernel options while trimming unrelated subsystems. 'run.sh' boots the built kernel in a VM using 'vng', exposes a GDB stub via QEMU '-s', and prepares a shell environment. 'gdb.sh' automates remote kernel debugging against TCP port 1234 and adds custom slab-inspection commands. 'find.py' is an auxiliary research tool that runs 'pahole' over the built kernel to identify candidate structures and offsets relevant to the 192-byte eventpoll slab layout and overwrite target selection. The patch files instrument 'fs/eventpoll.c', 'fs/pipe.c', and 'mm/filemap.c' to log slab state and pipe-buffer flag anomalies, helping validate the race and object overlap. Overall, this is a real exploit repository with operational local LPE capability, plus a tailored kernel-build/debug harness for reproducing and studying the vulnerability on Ubuntu Noble-derived kernels.

This repository is a standalone C proof-of-concept extracted from a larger Android kernel exploit chain for CVE-2026-43074. Its sole purpose is to perform the SELinux-disabling stage: it races the Linux/Android eventpoll loop-depth-check use-after-free and redirects a one-byte kernel write into selinux_state.enforcing, changing SELinux from Enforcing to Permissive. The README explicitly states this is not a full privilege-escalation exploit and omits the original payload stages that patched /system/bin/dumpstate to obtain root. Repository structure is compact and focused. src/main.c is the entry point: it checks /sys/fs/selinux/enforce, prepares heap state, and makes up to two attempts to run the zero-byte redirect primitive against TARGET_SELINUX_ENFORCING_ALIAS. src/late_refs.c contains the core race logic using epoll graphs, IPv6 multicast socket filters, setsockopt/getsockopt, and a trigger thread to hit the eventpoll UAF window and detect success. src/page.c implements heap shaping and known-page acquisition/reclaim, using many cloned child processes, socketpairs, SKB allocations, and the bundled KernelSnitch technique to recover a useful kernel address for the fake object placement. src/util.c only reads SELinux state. src/target.h hardcodes the target-specific kernel alias 0xffffff800236a2e0 for the Pixel 10 Pro / blazer build listed in the README. The bundled src/kernelsnitch/* headers provide helper code for timing, futex hashing, and mm_struct discovery/bruteforcing. These are support components for address discovery and heap manipulation, not separate exploits. The Makefile builds a static ARM64 Android binary named build/disabler using the Android NDK. Operationally, the exploit is highly target-specific. It is pinned to Pixel 10 Pro / blazer running kernel 6.6.118-android15-8-g53e6e091166e-ab15266607-4k and Android build fingerprint google/blazer/blazer:17/CP2A.260705.006/15641320:user/release-keys. Retargeting requires recomputing the selinux_state alias and likely depends on compatible slab layout behavior. Attack vector is local only; there are no remote C2 or exfiltration endpoints. The main observable artifacts are local kernel/SELinux file paths, procfs memory handles, the hardcoded kernel alias, and the IPv6 multicast group ff02::e713 used during the race.