CVE-2026-68138 v1.0.0

CVE-2026-68138 submission notes

Suggested catalog metadata

• Title: Linux Kernel CVE-2026-68138 - Local Privilege Escalation
• Type: Local privilege escalation
• Platform: Linux x86-64
• CVE: CVE-2026-68138
• Exploit author: A. Ramos <aramosf@gmail.com> (Twitter: @aramosf)
• Vulnerability discovery: Aldo Ariel Panzardo
• Project: https://github.com/aramosf/CVE-2026-68138
• Upstream fix: https://git.kernel.org/linus/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047
• Original report: https://patch.msgid.link/20260715114114.446841-1-qwe.aldo@gmail.com

Summary

CVE-2026-68138 is a race in the Linux traffic-control qdisc rate-table list
and reference count. Concurrent unprivileged flower-filter requests from user
and network namespaces can cause a use-after-free or double-free of a global
kmalloc-2k struct qdisc_rate_table. The supplied exploit converts that
condition into an initial-user-namespace root shell.

The main exploit was validated three times against vulnerable upstream commit
92d3817649df2b0b6a008a686c8275c88d7ef594. A separate build-specific variant
was validated against the unmodified Ubuntu package
linux-image-5.15.0-187-generic (5.15.0-187.197) on Ubuntu 22.04.5. The same
race failed to reach the reclaim stage on the fixed upstream commit after
approximately 126,000 requests.

Archive contents

• exploit.c: main upstream-kernel exploit.
• exploit-ubuntu-5.15.0-187.c: Ubuntu 22.04.5 build-specific variant.
• README.md: vulnerability, exploitation process, affected/fixed versions,
  requirements, build and run instructions.
• UBUNTU.md: exact Ubuntu package, default features, lab adjustments and
  QEMU reproduction procedure.
• ubuntu-lab/: scripts that construct the disposable Ubuntu QEMU lab.
• example-output.txt and ubuntu-example-output.txt: sanitized output from
  real successful QEMU executions.
• config.fragment: relevant options for the upstream-kernel test lab.
• SHA256SUMS: archive payload integrity manifest.

Build

The sources are intended for isolated, disposable QEMU guests:

gcc -O2 -static -pthread -Wall -Wextra -Werror \
  -o cve-2026-68138 exploit.c

gcc -O2 -static -pthread -Wall -Wextra -Werror \
  -o cve-2026-68138-ubuntu exploit-ubuntu-5.15.0-187.c

The Ubuntu variant is deliberately tied to 5.15.0-187-generic, requires the
documented QEMU preparation, and refuses a different release or a boot without
nokaslr. Read README.md and UBUNTU.md before running either variant.

Safety

The exploit intentionally corrupts kernel heap state. A missed race can panic
the guest. Run it only in an isolated disposable VM that you own, and reboot
from a clean snapshot between attempts.