PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The epoll uaf

guysrd.github.io | blog | #vulnerability-research | #memory-safety | #use-after-free | #android | #linux-kernel | #exploit-development | #rcu | #epoll
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Nicholas Carlini's epoll use-after-free in fs/eventpoll.c let RCU walkers race kfree() for a constrained write into a freed eventpoll; his Pixel 10 exploitation attempts fell short.
Published
Collected

Related coverage

blog · guysrd.github.io
I handed the epoll UAF to an agent
The author handed the epoll UAF (CVE-2026-46242) to Claude, which ported the exploit to a Pixel 10 and reached a root shell in the vold SELinux domain, fully agent-driven at roughly 30% reliability.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
research · starlabs.sg
When AI Makes 0-Days Feel Like N-Days
The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.
High · vulnerability · nebusec.ai
IonStack part III: Rooting Android 17 with GhostLock
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by Nebula Security that exists in every major distribution since 2011. After turning it into a stable privilege escalation and container escape, we took one step further and used GhostLock to develop the world's first public Android 17 root. This writeup covers the additional exploit techniques used to migrate the exploit for Android.
blog · guysrd.github.io
futex: remove_waiter stack uaf
A stack use-after-free in the Linux futex remove_waiter(), present since 2011, fixed in April 2026, leaves a waiter's pi_blocked_on dangling; the author triggered it but did not reach code execution.
blog · guysrd.github.io
The futex READ_ONCE
A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
Back