PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

futex: remove_waiter stack uaf

guysrd.github.io | blog | #vulnerability-research | #privilege-escalation | #use-after-free | #linux-kernel | #futex
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A stack use-after-free in the Linux futex remove_waiter(), present since 2011, fixed in April 2026, leaves a waiter's pi_blocked_on dangling; the author triggered it but did not reach code execution.
Published
Collected

Related coverage

blog · guysrd.github.io
I handed the epoll UAF to an agent
The author handed the epoll UAF (CVE-2026-46242) to Claude, which ported the exploit to a Pixel 10 and reached a root shell in the vold SELinux domain, fully agent-driven at roughly 30% reliability.
blog · guysrd.github.io
The futex READ_ONCE
A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
blog · guysrd.github.io
The epoll uaf
Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
High · vulnerability · swarm.ptsecurity.com
Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel
Alexander Popov presents kernel-hack-drill, the tooling that helped him exploit CVE-2024-50264, a race-condition use-after-free in the Linux kernel's AF_VSOCK (Pwnie 2025, Best Privilege Escalation).
Back