CVE-2026-68138

KO | EN

gitlite — search

#javascript #python #react #ai #typescript #llm #golang #go #android #awesome #pytorch #openai #mcp #open-source

(★ 18)

CVE-2026-68138 Linux qdisc rate-table race local privilege escalation PoC

CVE-2026-68138 Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CVE-2026-68138: Linux qdisc rate-table race to local root

![CVE-2026-68138 live exploit](https://raw.githubusercontent.com/aramosf/CVE-2026-68138/main/assets/CVE-2026-68138.gif)

This repository contains a proof-of-concept local privilege-escalation exploit
for **CVE-2026-68138**, a race in the Linux traffic-control rate-table code. In
the tested QEMU environment, the PoC escalates from an ordinary process with
outer UID 1000 to a shell with UID 0 in the initial user namespace.

> **Warning**
>
> This code intentionally corrupts kernel heap state. Use it only in an
> isolated, disposable VM that you own. A missed race or premature cleanup can
> panic the guest. Do not run it on a workstation, server, or third-party
> system.

## Vulnerability summary

`qdisc_get_rtab()` and `qdisc_put_rtab()` manage a process-global singly linked
list, `qdisc_rtab_list`, and a plain non-atomic `int refcnt`. Historically,
callers held the RTNL mutex, which serialized access to the list and reference
count.

The flower classifier sets `TCF_PROTO_OPS_DOIT_UNLOCKED`. An
`RTM_NEWTFILTER` request for a flower rule can consequently reach a police
action and call the qdisc rate-table helpers without RTNL:

```text
tc_new_tfilter()
  -> fl_change()
     -> tcf_exts_validate_ex()
        -> tcf_action_init()
           -> tcf_police_init()
              -> qdisc_get_rtab()/qdisc_put_rtab()
```

Concurrent requests using the same rate table can race the global list and its
reference count. The result is a use-after-free or double-free of
`struct qdisc_rate_table`, a 1056-byte object allocated from `kmalloc-2k` on
the tested x86-64 kernel.

Because the list is global rather than per-network-namespace, requests from
separate network namespaces still race the same object.

## Affected and fixed versions

The Linux CNA record identifies introduction commit
[`470502de5bdb`](https://git.kernel.org/stable/c/470502de5bdb1ed0def643a4458593a40b8f6b66),
released in Linux 5.1.

| Line | Status | Commit/version |
| --- | --- | --- |
| Linux before 5.1 | Not affected | The introducing change is absent |
| Linux 5.1 through 7.1.5 | Affected unless a vendor backport is present | `470502de5bdb` through the commit before the stable fix |
| Linux 7.1.y | Fixed | 7.1.6, [`fb29e1b41052`](https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d) |
| Linux 7.2 development series | Affected before rc5 | rc1 through rc4 |
| Mainline | Fixed | 7.2-rc5, [`f43ee0c0730d`](https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047) |

Distribution kernels frequently backport fixes without changing to the
upstream version shown above. Check whether either fixing commit—or the
equivalent qdisc rate-table spinlock change—is present in the exact kernel
source used by the system.

The exploit was developed and validated against vulnerable commit
`92d3817649df2b0b6a008a686c8275c88d7ef594`, the direct parent of the mainline
fix. The fixed-kernel control used
`f43ee0c0730d6191629b5ee1ceae27b1ebfdc047`.

## Ubuntu distribution status

As of **2026-08-12**, the
[Ubuntu CVE tracker search](https://ubuntu.com/security/cves?q=CVE-2026-68138)
did not return an entry for this CVE. The table below is therefore a direct
source inspection, not a Canonical security-status determination. Each linked
Ubuntu tag still has the unlocked `qdisc_rtab_list` and lacks the fixing
`qdisc_rtab_lock`.

| Ubuntu line | Inspected package/tag | Source result |
| --- | --- | --- |
| Ubuntu 22.04 GA | [`5.15.0-187.197`](https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/jammy/plain/net/sched/sch_api.c?h=Ubuntu-5.15.0-187.197) | Vulnerable code present; full exploit reproduced in QEMU |
| Ubuntu 22.04 HWE | [`6.8.0-136.136~22.04.1`](https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-hwe-6.8/+git/jammy/plain/net/sched/sch_api.c?h=Ubuntu-hwe-6.8-6.8.0-136.136_22.04.1) | Vulnerable code present; exploit chain not tested |
| Ubuntu 24.04 HWE | [`7.0.0-28.28~24.04.1`](https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux-hwe-7.0/+git/noble/plain/net/sched/sch_api.c?h=Ubuntu-hwe-7.0-7.0.0-28.28_24.04.1) | Vulnerable code present; this exploit chain is not compatible with its allocator hardening |
| Ubuntu 26.04 | [`7.0.0-28.28`](https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/resolute/plain/net/sched/sch_api.c?h=Ubuntu-7.0.0-28.28) | Vulnerable code present; this exploit chain is not compatible with its allocator hardening |

No corrected Ubuntu package was identified at that inspection date. Future
Ubuntu packages should be checked for a backport equivalent to the linked
upstream fixes rather than judged only by their version number.

The build-specific Ubuntu 22.04 exploit, QEMU lab, exact image checksum, and
conditions are documented in [`ubuntu/README.md`](ubuntu/README.md). It was
validated against the official `5.15.0-187-generic #197-Ubuntu` kernel with
memory-cgroup accounting enabled.

## Conditions required by the main PoC

The underlying bug and this particular exploit chain have different
requirements. The PoC was validated with:

- x86-64 Linux and four virtual CPUs;
- unprivileged user namespaces and network namespaces enabled;
- `CONFIG_USER_NS=y` and `CONFIG_NET_NS=y`;
- `CONFIG_NET_CLS=y`, `CONFIG_NET_CLS_FLOWER=y`,
  `CONFIG_NET_CLS_ACT=y`, and `CONFIG_NET_ACT_POLICE=y`;
- classic BPF socket filters and BPF JIT support;
- `CONFIG_TMPFS_XATTR=y` for the `simple_xattr` heap spray;
- `CONFIG_MODULES=y` and a usable `/sbin/modprobe` for the final root helper;
- `CONFIG_MEMCG=n`, so the qdisc/BPF/pipe/xattr allocations used by this chain
  share the expected `kmalloc-2k` cache;
- a per-process file-descriptor limit of at least 4096; and
- a disposable VM with approximately 5 GiB of RAM.

`CONFIG_SLAB_BUCKETS=y`, freelist randomization, and freelist hardening were
enabled in the successful test kernel. KASLR is not inherently bypassed with a
hard-coded address: the PoC obtains the required page and operations pointers
from the pipe leak. The supplied lab used `nokaslr` to simplify debugging.

Kernels with memory-cgroup accounting enabled or different allocator/cache
layouts require a different reclaim strategy. The PoC deliberately refuses to
claim portability across arbitrary distribution configurations.

The separate Ubuntu variant implements that different reclaim strategy; its
requirements are intentionally narrower and are listed in
[`ubuntu/README.md`](ubuntu/README.md).

## Exploitation process

### 1. Trigger the qdisc race

Four worker threads enter distinct network namespaces and create flower
filters with police actions. Three workers take the successful action path;
one supplies a deliberately invalid estimator after acquiring both rate-table
references, forcing the cleanup path. This combination makes concurrent
reference-count and list manipulation reproducible without sharing flower
classifier state between workers.

### 2. Reclaim `qdisc_rate_table` with classic BPF

After every netlink request, the same CPU immediately attaches a 133-instruction
classic-BPF filter. Its 1064-byte instruction array is allocated from
`kmalloc-2k` and is shaped so the bytes overlapping `qdisc_rate_table.next` and
`qdisc_rate_table.refcnt` initially remain valid.

The final instruction contains a per-socket marker. `SO_GET_FILTER` lets the
PoC detect when one socket's `orig_prog->filter` pointer has been redirected to
another live BPF allocation. This yields two socket objects referring to the
same instruction buffer.

### 3. Convert the alias into a pipe leak

Closing one owner defers the actual free through `sk_filter_release_rcu()`.
After the grace period, the PoC allocates 32-slot pipe rings:

```text
32 * sizeof(struct pipe_buffer) = 32 * 40 = 1280 bytes -> kmalloc-2k
```

One ring reclaims the aliased BPF buffer. Reading the other socket with
`SO_GET_FILTER` discloses a live `pipe_buffer`, including its `page` and `ops`
pointers and the offset of the `/sbin/modprobe` page-cache entry.

### 4. Forge a mergeable pipe buffer

Closing the second socket frees the live pipe ring after another RCU grace
period, while the corresponding `pipe_inode_info` still references it. A
`simple_xattr` spray reclaims the 1280-byte ring and places the leaked
`pipe_buffer` at the expected slot with `PIPE_BUF_FLAG_CAN_MERGE` set.

Writing to each candidate pipe eventually appends attacker-controlled bytes to
the page-cache page backing the ELF entry point of `/sbin/modprobe`. The PoC
reads the file back and proceeds only after confirming the exact overwrite.

### 5. Execute in the initial namespace

Recent kernels no longer use the historical invalid-binfmt module-autoload
fallback in `search_binary_handler()`. This PoC instead creates an AF_INET
datagram socket with unsupported protocol 253. `inet_create()` requests the
missing `net-pf-2-proto-253-type-2` module, causing the kernel to execute the
overwritten `/sbin/modprobe` as initial-namespace root.

The injected entry-point payload writes a proof file and opens a root shell on
the QEMU serial console.

## Building the PoC

The guest binary is statically linked:

```bash
./build.sh
```

Equivalent command:

```bash
gcc -O2 -static -pthread -Wall -Wextra -Werror \
  -o build/exploit exploit.c
```

The resulting binary must be exposed inside the guest as
`/exploit/CVE-2026-68138`. The tested lab used QEMU's read-write 9p share. The
root helper expects that share at `/chroot/exploit` from the initial mount
namespace; adjust `helper_command` in `exploit.c` if the lab uses another
layout.

The relevant test-kernel options are recorded in
[`config.fragment`](config.fragment). They are a fragment, not a complete
production kernel configuration.

## Running

From the unprivileged guest shell:

```bash
id
/exploit/CVE-2026-68138
```

The race is probabilistic. On a miss the PoC prints:

```text
[-] no BPF alias found in this attempt
```

Reboot the VM before retrying. Do not rerun it in the same guest: the global
qdisc list may already have been corrupted.

A successful execution reaches:

```text
[+] confirmed dangling orig_prog->filter pointer
[+] pipe leak: page=<kernel pointer> ops=<kernel pointer> off=0x60f len=1 flags=0
[+] page-cache overwrite via dangling pipe
[+] controlled page-cache write confirmed; triggering helper
[+] CVE-2026-68138 initial-namespace root shell
uid=0(root) gid=0(root) groups=0(root)
[+] ROOT PROOF: uid=0(root) gid=0(root) groups=0(root)
```

The complete sanitized transcript is in
[`docs/example-output.txt`](docs/example-output.txt).

## Reproduced results

The full chain was completed three times from fresh vulnerable VM boots. The
final binary produced:

```text
outer identity: uid=1000(user)
alias:          classic-BPF orig_prog->filter overlap
leak:           live pipe_buffer page and ops pointers
write:          verified /sbin/modprobe page-cache modification
final identity: uid=0(root) gid=0(root) groups=0(root)
```

The same binary was run against the fixed commit with the same four-vCPU
topology. Approximately 126,000 race requests completed without a BPF alias,
and no pipe or page-cache stage was reached.

### Ubuntu 22.04.5 QEMU result

The Ubuntu-specific variant was also run against the exact official
`5.15.0-187.197` generic kernel. The guest booted with four vCPUs, normal
memory-cgroup accounting, and `nokaslr` as the only exploit-specific kernel
argument.

The Ubuntu kernel was not recompiled: the test used the distribution's
unchanged `vmlinuz-5.15.0-187-generic` and matching official modules. The
[Ubuntu prerequisite table](ubuntu/README.md#stock-ubuntu-features-versus-lab-adjustments)
separates stock kernel features from runtime and QEMU lab adjustments.

The starting account had no sudo access or supplementary groups:

```text
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu)
```

From a fresh snapshot, the exploit obtained the BPF alias, reclaimed it through
cgroup-v2 `simple_xattr` objects and blocking `select()` bitmaps, verified that
`/proc/sys/kernel/modprobe` contained `/tmp/x`, and reached:

```text
[+] CVE-2026-68138 Ubuntu initial-namespace root shell
uid=0(root) gid=0(root) groups=0(root)
root@cve-2026-68138-jammy:/# id
uid=0(root) gid=0(root) groups=0(root)
```

See the [real QEMU transcript](docs/ubuntu-22.04.5-qemu-output.txt) and the
[Ubuntu lab instructions](ubuntu/README.md). The variant hard-codes the
`modprobe_path` address for this package and therefore requires `nokaslr`; it
does not claim a KASLR bypass or compatibility with another Ubuntu build.

## Fix

The patch is already part of the Linux kernel and is therefore not duplicated
in this repository. The canonical stable and mainline fixing commits are linked
in the references below.

## References

- [Official CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68138.json)
- [Stable fix for Linux 7.1.y](https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d)
- [Mainline fix](https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047)
- [Ubuntu CVE tracker search](https://ubuntu.com/security/cves?q=CVE-2026-68138)
- [Official Ubuntu Jammy cloud image](https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img)

Research and exploit implementation: **A. Ramos** `<aramosf@gmail.com>`
(Twitter: [@aramosf](https://twitter.com/aramosf)).

CVE-2026-68138

CVE-2026-68138 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

CVE-2026-68138

CVE-2026-68138 Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README