PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The futex READ_ONCE

guysrd.github.io | blog | #vulnerability-research | #memory-safety | #linux-kernel | #race-condition | #futex
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
Published
Collected

Related coverage

blog · guysrd.github.io
futex: remove_waiter stack uaf
A stack use-after-free in the Linux futex remove_waiter(), present since 2011, fixed in April 2026, leaves a waiter's pi_blocked_on dangling; the author triggered it but did not reach code execution.
blog · guysrd.github.io
The epoll uaf
Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · idnsec.com
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
tool · github.com
CVE-2026-68138 PoC: Linux qdisc rate-table race local privilege escalation
The public PoC turns the kernel race into a reproducible local root-escalation chain. It requires specific kernel configuration and an isolated lab, but hosts exposing the relevant namespace, traffic-control, and module-loading capabilities should verify that the upstream fix or an equivalent backport is present.
Back