RustyTux is a Linux kernel local privilege-escalation exploit for a strparser

race publicly disclosed on the Linux kernel mailing list.

It targets an ESP-in-TCP use-after-free race in which an active receive parser

overlaps with socket teardown and rearms strparser's msg_timer_work after

strp_done() has canceled it.

This exploit is timing-sensitive and non-deterministic; race delays must be

tuned for each target environment.

The exploit attempts to derive the randomized kernel base through an x86

prefetch timing side channel, race ESP-in-TCP receive parsing against socket

teardown, and reclaim the freed espintcp_ctx with user-key payloads.

Race timelines can be found here, and the callback gadget is documented here.

As of September 2026, the race is present in the standard kernels shipped by multiple major Linux distributions, including CentOS Stream 9 and Ubuntu 26.04 LTS. It is reachable by an unprivileged local user without Linux capabilities.

The included offsets and callback shape target this CentOS Stream 9 build:

CentOS Stream 9

kernel-core-5.14.0-745.el9.x86_64

Porting the exploit requires updating its kernel-build-specific offsets and

constants, plus adapting the final modprobe_path trigger.

Run the exploit as an ordinary unprivileged user:

./exploit

By default, the exploit tries predefined timings for socket close and delivery

of the final, timer-arming partial frame. The schedule starts with later

socket-close delays and progressively shortens them, while the final-frame delay

remains within a small preset range. --fixed-timing repeatedly uses only the

default timing pair, while --aggressive extends the schedule with earlier

close timings. --max-windows N limits the number of race windows (0 is

unbounded), and --quiet reduces status output. Run ./exploit --help for the

complete option summary.

The replacement timer callback attempts to change modprobe_path to /tmp/.x.

The exploit then attempts to invoke the helper, create a setuid shell at

/tmp/rootsh, and execute:

/tmp/rootsh -p

The build is static and uses the sources under src/:

make

make exploit

make prefetch

make clean

make and make exploit build the exploit. The separate prefetch target

builds the KASLR helper as a standalone diagnostic binary.

The exploit exits before starting the race if it cannot leak the kernel base. With a valid kernel base and successful heap reclaim, it attempts local privilege escalation. A crash-only variant can omit the KASLR leak and use the same race as an unprivileged kernel denial of service.

The exploit in this repository is provided strictly for educational and research purposes. The author does not endorse or encourage unauthorized access to systems.