{“lastseen”:”2026-05-27T13:27:56″,”description”:”Titles: Linux Kernel Local Privilege Escalation CVE-2026-43284 \/ CVE-2026-43500 Author: nu11secur1ty Date: 2026-05-11 Vendor: Linux Kernel Software: Linux Kernel All major distributions Vulnerability Type: Page-Cache Write \/ Memory Corruption Status:…”,”published”:”2026-05-27T00:00:00″,”modified”:”2026-05-27T00:00:00″,”type”:”exploitdb”,”title”:”Linux Kernel – Local Privilege Escalation”,”source”:””,”references”:””,”id”:”EDB-ID:52585″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-43284″,”CVE-2026-43500″],”sourceData”:”# Titles:** Linux Kernel Local Privilege Escalation (CVE-2026-43284 \/\\r\\nCVE-2026-43500)\\r\\n# Author:** nu11secur1ty\\r\\n# Date:** 2026-05-11\\r\\n# Vendor:** Linux Kernel\\r\\n# Software:** Linux Kernel (All major distributions)\\r\\n# Vulnerability Type:** Page-Cache Write \/ Memory Corruption\\r\\n# Status:** HIGH \/ CRITICAL\\r\\n\\r\\n—\\r\\n\\r\\n## Description\\r\\n\\r\\nThe **\\”Kukurigu\\”** exploit represents a sophisticated local privilege\\r\\nescalation (LPE) vector targeting the Linux kernel’s page-cache management.\\r\\nThe vulnerability is not a single bug, but a strategic chain of two\\r\\ndistinct flaws that allow an unprivileged attacker to bypass standard\\r\\nfilesystem write protections.\\r\\n\\r\\n### Vulnerability Chain:\\r\\n1. **CVE-2026-43284 (xfrm-ESP):** A logic error in the ESP protocol\\r\\nimplementation when Extended Sequence Numbers (ESN) are active. This flaw\\r\\nallows a local user to perform arbitrary 4-byte writes directly into the\\r\\npage-cache.\\r\\n2. **CVE-2026-43500 (RxRPC):** A flaw in the RxRPC protocol that\\r\\nfacilitates in-place decryption of data within page-cache pages.\\r\\n\\r\\n### Impact Analysis:\\r\\nBy chaining these vulnerabilities, an attacker can modify the\\r\\nmemory-resident pages of setuid binaries (e.g., `\/usr\/bin\/su` or\\r\\n`\/usr\/bin\/sudo`) or sensitive system files (e.g., `\/etc\/passwd`). Because\\r\\nthe modification occurs in the page-cache, the attacker effectively\\r\\n\\”poison\\” the execution environment.\\r\\n\\r\\n**Key Advantages for Attacker:**\\r\\n* **Stability:** No race conditions involved.\\r\\n* **Reliability:** Near 100% success rate on tested environments.\\r\\n* **Stealth:** Does not trigger kernel panics or system instability upon\\r\\nfailure.\\r\\n* **Persistence:** Affects kernels spanning nearly 9 years (2017-01-17 to\\r\\n2026-05-10).\\r\\n\\r\\n—\\r\\n\\r\\n## Affected Systems (Verified)\\r\\nThe following distributions have been tested and confirmed vulnerable:\\r\\n* **Ubuntu:** 24.04.4 \/ 25.10 \/ 26.04\\r\\n* **RHEL:** 10.1\\r\\n* **openSUSE:** Tumbleweed\\r\\n* **CentOS Stream:** 10\\r\\n* **AlmaLinux:** 10\\r\\n* **Fedora:** 44\\r\\n\\r\\n—\\r\\n\\r\\n## Proof of Concept (PoC)\\r\\n\\r\\n### Execution Flow:\\r\\n“`bash\\r\\n# Compiling the exploit tool\\r\\n$ gcc -O2 kukurigu.c -o kukurigu_exploit\\r\\n\\r\\n# Running the exploit against a target binary\\r\\n$ .\/kukurigu_exploit –target \/usr\/bin\/su –method esp\\r\\n\\r\\n[+] Initializing Kukurigu LPE engine…\\r\\n[+] Exploiting CVE-2026-43284 (xfrm-ESP write)…\\r\\n[+] Exploiting CVE-2026-43500 (RxRPC decryption)…\\r\\n[+] Page-cache poisoned successfully for \/usr\/bin\/su.\\r\\n[+] Dropping into root shell…\\r\\n\\r\\n# id\\r\\nuid=0(root) gid=0(root) groups=0(root)\\r\\n\\r\\n\\r\\n[+]Exploit:\\r\\n[href](\\r\\nhttps:\/\/github.com\/nu11secur1ty\/CVE-mitre\/tree\/main\/2026\/CVE-2026-43284-CVE-2026-43500\\r\\n)\\r\\n\\r\\n# Demo:\\r\\n[href](https:\/\/www.patreon.com\/posts\/cve-2026-43284-157962202)\\r\\n\\r\\n# Patch if you want:\\r\\n[href](https:\/\/www.patreon.com\/posts\/cve-2026-43284-157966167)\\r\\n\\r\\n# Time spent:\\r\\n01:30:00\\r\\n\\r\\n–\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstormsecurity.com\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\nhome page: https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\nnu11secur1ty \\u003chttps:\/\/www.asc3t1c-nu11secur1ty.com\/\\u003e\\r\\n– \\r\\n\\r\\nSystem Administrator – Infrastructure Engineer\\r\\nPenetration Testing Engineer\\r\\nExploit developer at https:\/\/packetstorm.news\/\\r\\nhttps:\/\/cve.mitre.org\/index.html\\r\\nhttps:\/\/cxsecurity.com\/ and https:\/\/www.exploit-db.com\/\\r\\n0day Exploit DataBase https:\/\/0day.today\/\\r\\nhome page: https:\/\/www.asc3t1c-nu11secur1ty.com\/\\r\\nhiPEnIMR0v7QCo\/+SEH9gBclAAYWGnPoBIQ75sCj60E=\\r\\n nu11secur1ty \\u003chttp:\/\/nu11secur1ty.com\/\\u003e”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52585″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52585″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-27T13:27:56″,”description”:”Titles: Linux Kernel Local Privilege Escalation CVE-2026-43284 \/ CVE-2026-43500 Author: nu11secur1ty Date: 2026-05-11 Vendor: Linux Kernel Software: Linux Kernel All major distributions Vulnerability Type: Page-Cache…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,40,15,13,7,11,5],"class_list":["post-57401","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n