Use-after-free in Linux kernel eventpoll ep_remove()

Repository is a small standalone Linux kernel local privilege escalation PoC for CVE-2026-46242 ('Bad Epoll'). The main artifact is exploit.c, a large C program implementing a multi-phase exploit chain against a race-condition use-after-free in the Linux epoll subsystem. The code is not part of a common exploit framework. README.md briefly states this is a 'full poc and lpe' and lists affected kernel ranges. analysis.md is a long technical write-up describing the vulnerability, root cause in fs/eventpoll.c, affected versions, exploitation strategy, and defensive context. Two GitHub Actions workflows automate compilation and QEMU-based verification against Ubuntu mainline kernel 6.4, including one variant that disables KASLR with the nokaslr boot parameter and relaxes kptr_restrict/dmesg_restrict to make testing easier. The exploit itself is clearly intended as a local privilege escalation tool rather than a remote exploit. It uses epoll, timerfd, eventfd, pipes, atomics, threading, CPU affinity, and timing primitives to repeatedly trigger a close-vs-close race in linked epoll objects. The visible structure shows phases for setup, linked epoll pair creation, heap spraying, slab hole creation, repeated race attempts, cross-cache reclamation, an infoleak verification step, and finally ROP-based privilege escalation. The code comments and visible symbols indicate it resolves or accepts a kernel base address, derives absolute addresses for commit_creds, init_cred, a KPTI trampoline, and a pop rdi gadget, then builds and triggers a kernel ROP chain to call commit_creds(init_cred) and return to user mode where a root shell is spawned. Capabilities: unprivileged local execution, repeated race triggering, heap shaping, optional KASLR bypass/address discovery, kernel infoleak checking, kernel ROP construction, privilege escalation to root, and root shell spawning. The exploit appears to be a research PoC rather than a fully weaponized tool: it contains extensive commentary, explicit failure messages, and even notes that some corruption stages may not be fully implemented ('f_op corruption not implemented in this PoC'). That makes POC the best maturity classification despite the presence of a root-shell payload path. Fingerprintable endpoints are mostly local file paths and CI download URLs. In the exploit code, notable paths include /proc/kallsyms for kernel symbol leakage, /proc/self/fdinfo for leak verification, and /bin/sh for post-exploitation shell execution. In the workflows, the repository downloads exploit.c from raw.githubusercontent.com and a kernel package from kernel.ubuntu.com, then mounts /proc, /sys, and /dev inside an initramfs and executes /bin/exploit. Overall, the repository's purpose is to demonstrate and validate exploitation of a Linux kernel epoll UAF leading to local root on vulnerable kernels, with supporting documentation and reproducible QEMU test harnesses.

Repository contains a single C proof-of-concept exploit and a README. The main file, CVE-2026-46242.c, is a self-contained local Linux kernel exploit targeting CVE-2026-46242, a use-after-free race in the eventpoll/epoll subsystem. The exploit creates multiple interconnected epoll instances, starts a racing thread that repeatedly closes and recreates selected epoll file descriptors, and concurrently performs repeated close/recreate operations on target descriptors to trigger a UAF condition. It also performs light file-descriptor spraying using /dev/null and dup() to improve allocator reuse and detect or leverage corruption. The intended post-exploitation outcome is local privilege escalation; if the process becomes UID 0, it executes /bin/sh. There are no network indicators or remote endpoints because this is a purely local exploit. The README describes affected kernel ranges, impact, and mitigation, but it inaccurately claims the repository does not contain exploit code; the C file is clearly exploit code. Overall, this is an operational local privilege-escalation PoC with a basic hardcoded payload rather than a detection-only script.