CVE-2026-64582: PoC Exploit Published for Kernel LPE

TL;DR

A researcher published full technical details and working proof-of-concept exploit code for CVE-2026-64582. The flaw is a use-after-free in the Linux kernel RDMA/rxe driver. It started as a denial of service but was developed into a reliable local privilege escalation. A patch is available upstream.

Why This Matters

The public release changes the risk picture. Both the vulnerability write-up and the proof-of-concept exploit code are now openly available. As a result, the barrier to abuse drops sharply. A local attacker can use the flaw to gain root on affected systems. The bug carries a CVSS score of 7.0.

How the Attack Works

The problem sits in the rxe_mmap() function of the Soft-RoCE (RXE) driver. This driver is a software implementation of RDMA over Ethernet. A race condition triggers the use-after-free.

An attacker registers a Completion Queue, maps it, then destroys it. The destroy path lacks a lock. Consequently, one thread frees the mmap object while another still uses it. The researcher then extended the race and chained it into a “refcount increment primitive for every fork in kmalloc-64,” which leads to dirty pageflags and finally a root shell.

Affected Versions

The flaw affects Linux kernels with the vulnerable RDMA/rxe driver. Systems that load the Soft-RoCE module are exposed to local attackers.

Patch and Mitigation

Maintainers fixed the bug in commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561. The fix adds an atomic refcount check under lock to close the race. Admins should update their kernels now. Where RDMA is unused, unloading the rxe module reduces the attack surface.

The researcher documented the full chain in a detailed technical write-up on the flaw. The matching proof-of-concept exploit code is hosted on GitHub Gist. No exploitation in the wild has been confirmed at this time.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.