rjt-gupta/page-cache-corruption-lpes

This repository contains three working exploits for the Linux kernel that let an ordinary user gain full administrator (root) access in seconds. The author, Rajat Gupta who works in offensive security at Qualcomm, presents these as proof-of-concept code tied to real CVE assignments. The bugs share a family resemblance with famous older exploits called Dirty COW and Dirty Pipe. All three exploits target the kernel's page cache, which is the in-memory copy of files that programs actually read and run. The original file on disk is never modified, so file integrity checkers see nothing wrong. When the system tries to run a trusted program like su, it loads the corrupted version from memory and instead executes the attacker's code with root privileges. The three exploits differ in how they trick the kernel and how they write their payload. Dirty Pedit abuses the network traffic control subsystem through an integer wraparound, writes four bytes per packet, and needs no cryptographic tricks, getting root in under one second. The other two, skb_shift and GRO Flag Loss, both exploit a lost shared-fragment flag in different networking paths, then use ESP decryption to write one byte per packet over roughly ten seconds. The README documents the affected kernel versions, ranging from Linux 3.9 (2013) through 7.1 release candidates in 2026. It states every major distribution was affected by default with no special hardening required. The author reports that all vulnerabilities were responsibly disclosed to kernel maintainers, and patches are merged and backported to stable trees. Each exploit is a single C file compiled with gcc using no dependencies beyond the standard C library. The README includes sample build commands and example output showing an unprivileged user becoming root. The author notes the exploits are published for educational and defensive purposes now that fixes are available, and that rebooting or dropping caches restores the original files. The full README is longer than what was shown.