PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

calif.io | vulnerability | CVE-2025-38617 | #vulnerability-research | #linux | #exploitation | #linux-kernel | #race-condition | #cve-2025-38617
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.
CVE
CVE-2025-38617
Published
Collected

Related coverage

vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · idnsec.com
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
tool · github.com
CVE-2026-68138 PoC: Linux qdisc rate-table race local privilege escalation
The public PoC turns the kernel race into a reproducible local root-escalation chain. It requires specific kernel configuration and an isolated lab, but hosts exposing the relevant namespace, traffic-control, and module-loading capabilities should verify that the upstream fix or an equivalent backport is present.
blog · guysrd.github.io
The futex READ_ONCE
A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
Back