How a simple Linux kernel memory corruption bug can lead to complete system compromise

Summary: Google Project Zero's Jann Horn documented a Linux kernel locking bug in the tiocspgrp ioctl handler, where the lock is taken on the tty pointer while the pgrp member of real_tty is modified, allowing concurrent TIOCSPGRP calls on both ends of a pseudoterminal to skew struct pid reference counts. Horn exploited the resulting use-after-free against Debian Buster's 4.19.0-13-amd64 kernel, using the kernel page fault from a freed struct pid as a signal that the object had been freed before continuing the exploit.
Bottom line: The bug lives in pseudoterminals, which unprivileged userspace can create freely by opening /dev/ptmx, and the freed struct pid was allocated from a kmem_cache merged with struct seq_file and struct epitem - so a refcount skew reachable from an ordinary ioctl is the starting point for full system compromise.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026