[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92715":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":17,"fork":17,"defaultBranch":18,"hasWiki":17,"hasPages":17,"topics":19,"createdAt":9,"pushedAt":9,"updatedAt":20,"readmeContent":21,"aiSummary":22,"trendingCount":14,"starSnapshotCount":14,"syncStatus":23,"lastSyncTime":24,"discoverSource":25},92715,"CVE-2026-43499","MobiusM\u002FCVE-2026-43499","MobiusM","CVE-2026-43499 PoC",null,"C",86,23,1,0,14,42.54,false,"main",[],"2026-07-22 04:02:06","# CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free\n\n## Bug\n\n`remove_waiter()` in `kernel\u002Flocking\u002Frtmutex.c` is used by the slowlock paths but also for proxy-lock rollback in `rt_mutex_start_proxy_lock()` when invoked from `futex_requeue()`.\n\nIn the proxy-lock case `waiter::task` is not `current`, but `remove_waiter()` incorrectly operates on `current`. This causes three problems:\n\n1. The rbtree dequeue happens without `waiter::task::pi_lock` being held.\n2. The waiter task's `pi_blocked_on` is not cleared, leaving a dangling pointer primed for use-after-free.\n3. `rt_mutex_adjust_prio_chain()` operates on the wrong task.\n\n**CWE-416** (Use After Free). CVSS 3.1: **7.8 HIGH** (Local, Low complexity, Low privileges required).\n\nAffected: Linux 2.6.39 through 6.18.x; patched in 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4.\n\n## Usage\n\n**Prerequisites:** Android NDK 27, CMake ≥ 3.22, `adb`.\n\n```bash\ncmake -B build -G Ninja\ncmake --build build\nadb push build\u002Ftrigger \u002Fdata\u002Flocal\u002Ftmp\u002Ftrigger\nadb shell chmod +x \u002Fdata\u002Flocal\u002Ftmp\u002Ftrigger\nadb shell \u002Fdata\u002Flocal\u002Ftmp\u002Ftrigger\n```\n\nExpected output on a vulnerable device ends with a kernel panic:\n\n```\nUnable to handle kernel write to read-only memory\n```\n\n## Credits\n\n**Reported by:**\n- Yuan Tan\n- Yifan Wu\n- Juefei Pu\n- Xin Liu\n\n**Fix authored by:** Keenan Dong  \n**Fix committed by:** Thomas Gleixner  \n**Commit:** [`3bfdc63`](https:\u002F\u002Fgithub.com\u002Ftorvalds\u002Flinux\u002Fcommit\u002F3bfdc63936dd4773109b7b8c280c0f3b5ae7d349) — rtmutex: Use waiter::task instead of current in remove_waiter()\n","这是一个针对Linux内核CVE-2026-43499漏洞（futex PI机制中的Use-After-Free）的原理验证（PoC）实现。项目用C语言编写，通过构造特定的futex重排（requeue）操作触发rtmutex中remove_waiter()函数对错误任务上下文的操作，导致pi_blocked_on指针悬空，最终引发本地提权或内核崩溃。其技术特点是精准复现CWE-416漏洞路径，依赖Android NDK交叉编译并支持ADB部署，在未修复的Linux内核（2.6.39–6.18.x）上可稳定触发panic。适用于安全研究人员进行漏洞复现、补丁验证及内核安全测试场景。",2,"2026-07-10 02:30:15","CREATED_QUERY"]