Add kernelCTF CVE-2026-23394_lts_cos_mitigation

pocs/linux/kernelctf/CVE-2026-23394_lts_cos_mitigation/docs/vulnerability.md

@@ -0,0 +1,30 @@
+# CVE-2026-23394
+
+- Requirements:
+    - Capabilities: not required
+    - Kernel configuration: `CONFIG_UNIX=y`
+    - User namespaces: not required
+- Introduced by: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=118f457da9ed58a79e24b73c2ef0aa1987241f0e (af_unix: Remove lock dance in unix_peek_fds().)
+- Fixed by: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e5b31d988a41549037b8d8721a3c3cae893d8670 (af_unix: Give up GC if MSG_PEEK intervened.)
+- Affected Versions: 6.10 - 6.18
+- Affected component, subsystem: net/unix (Unix Sockets)
+- Cause: Race Condition leading to UAF
+- URL: https://www.cve.org/CVERecord?id=CVE-2026-23394
+- A regression to CVE-2021-0920: Android sk_buff use-after-free in Linux.
+
+## Description
+
+There is a race condition in the Linux kernel's Unix Sockets Garbage Collector
+(`net/unix/garbage.c`) where an inflight file's `f_count` can be incremented by
+using `MSG_PEEK` after the GC decides that the file is a garbage candidate but
+before the GC finishes checking.
+
+It is possible to peek an inflight unix socket from another socket and then close
+the receiver. In this case the GC checks both sockets as a garbage candidate,
+treating the entire SCC as dead.
+
+The patch uses `seqcount_t` for flagging that `MSG_PEEK` has occurred. At the
+start of an SCC checking the patch saves the counter and checks if any
+`MSG_PEEK` intervened before the final decision. This guarantees that `MSG_PEEK`
+can't change the GC internal state and affect the GC decision right in the middle
+of the checking.

pocs/linux/kernelctf/CVE-2026-23394_lts_cos_mitigation/exploit/cos-121-18867.294.134

@@ -0,0 +1 @@
+lts-6.12.74

pocs/linux/kernelctf/CVE-2026-23394_lts_cos_mitigation/exploit/lts-6.12.74/Makefile

@@ -0,0 +1,36 @@
+CC       := g++
+CPPFLAGS := -Ikernel-research/libxdk/include
+CFLAGS   := -O0 -static -std=c++17 -pthread
+LDFLAGS  := -Lkernel-research/libxdk/lib
+LDLIBS   := -lkernelXDK -lpthread
+
+TARGETS := exploit exploit_debug
+SRC     := exploit.cc
+
+.PHONY: all prerequisites run clean
+
+all: prerequisites exploit
+
+prerequisites: target_db.kxdb kernel-research/libxdk/lib/libkernelXDK.a
+
+target_db.kxdb:
+	wget -O $@ https://storage.googleapis.com/kernelxdk/db/kernelctf.kxdb
+
+kernel-research:
+	git clone --depth 1 https://github.com/google/kernel-research.git $@
+
+kernel-research/libxdk/lib/libkernelXDK.a: | kernel-research
+	cd kernel-research/libxdk && ./build.sh
+
+exploit: $(SRC)
+	$(CC) $(CPPFLAGS) $(CFLAGS) $< -o $@ $(LDFLAGS) $(LDLIBS)
+
+exploit_debug: CFLAGS += -g
+exploit_debug: $(SRC)
+	$(CC) $(CPPFLAGS) $(CFLAGS) $< -o $@ $(LDFLAGS) $(LDLIBS)
+
+run: exploit
+	./$<
+
+clean:
+	rm -rf $(TARGETS) target_db.kxdb kernel-research