Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation
Do Son 
TL;DR
A researcher published a proof-of-concept exploit for a Linux kernel AF_PACKET race condition. The flaw enables local privilege escalation from an ordinary user to root. Upstream fixed it in commit 03390aa, first included in the 7.2-rc7 tag. No CVE identifier has been assigned yet, so this report tracks the bug by its fix commit.
Tracking ID: CVE Pending / TBA. As of the research date (2026-08-13), no public CVE was associated with this fix.
Why It Matters
The exploit starts as a normal user with no special groups. From there, it reaches root in the initial user namespace. That makes this a serious local privilege escalation risk on affected builds.
The bug lives in a core networking path used across many systems. Notably, the researcher achieved root with KASLR, SMEP, SMAP, and AppArmor all left enabled. As a result, several standard defenses did not stop the demonstrated chain.
Exploitation Status
A public proof-of-concept exists on GitHub. However, it is build-specific and was validated against one exact upstream kernel. No in-the-wild exploitation has been confirmed. The researcher stresses the code targets a laboratory build, not a stock distribution package.
How the Attack Works
The vulnerability sits in the AF_PACKET send path, specifically packet_snd(). The function read the device header length more than once while building a raw-packet buffer.
Because of that, concurrent device reconfiguration could desynchronize two values. The kernel then allocated a buffer with one header length and reserved space with another. Consequently, a negative buffer movement placed the write pointer before the buffer start.
The result is an out-of-bounds write of attacker data. To win the race reliably, the public proof-of-concept for this AF_PACKET race stalls the send with a FUSE-backed buffer. While the send is paused, it swaps a bonding device between two link-layer layouts with different header lengths. That timing turns the race into a controlled memory write.
From that primitive, the chain leaks a kernel pointer to defeat KASLR. It then corrupts adjacent objects to forge a credential and reach a controlled callback. Finally, that callback grants root. The report describes the mechanism only and includes no working steps here.
Affected Versions
The upstream Fixes tag points to commit b84bbaf7a6c8 as the introducing change. Kernels remain affected until they include the correcting commit or an equivalent backport.
The researcher validated the flaw against Linux 7.2.0-rc3+ at commit 92d3817649df. Mainline fixed it in commit 03390aa32e66, first shipped in the 7.2-rc7 tag.
Do not judge exposure by the kernel version string alone. Vendors often backport networking fixes without changing the mainline version number. Therefore, inspect the source or package changelog for the fix commit.
Patch and Mitigation Steps
First, update to a kernel that contains commit 03390aa or a vendor backport. Confirm the fix in the package changelog rather than by version number.
Next, reduce local exposure on shared and multi-tenant hosts. Where policy allows, restrict unprivileged user namespaces, since the exploit relies on them to reach the vulnerable path. You can also limit local access until patched kernels are deployed.
Because a public PoC exists, treat patching as a priority once a fixed build is available. Track your distribution’s advisories for a backport and a formal CVE assignment.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
