No Time to Pwn: CVE-2026-72018 Linux Kernel LPE | XBOW

What it is

CVE-2026-72018, an out-of-bounds write in the Linux kernel's dibs_loopback (SMC-D over DIBS) driver, exploited by XBOW to root. The summary has the mechanism; what it omits is the scope an engineer needs to judge risk: the write was demonstrated on Ubuntu 24.04, Linux 7.1.0-rc6/x86_64, with all kernel mitigations disabled, and reliability was 22 successes out of 100 boots, first success on the 7th boot. Timeline: reported 2026-06-19, patch approved to LKML 2026-07-07, CVE assigned/public 2026-08-17.

How it works (the exploitation detail the summary compresses)

The OOB target is a single 16384-byte folio; a forged dmbe_idx pushes offset = bufsize * dmbe_idx past dmb_node->len, writing the 32-byte CDC header into adjacent heap. On a send-only connection only the tail 16 bytes (offsets 16–31, the consumer cursor and res3) are non-random — so the usable primitive is 16 zero bytes at an attacker-chosen offset that must be a multiple of 16KB, across a range of several MB. Those zeros land on cred's suid/sgid/euid/egid; the kernel reads euid == 0 as root, and setresuid(0,0,0) yields a shell. No infoleak or address knowledge needed.

Three conditions make it fire, all of which the operator controls, none guaranteed:

• Pin the target buffer by capturing a warmup connection's CLC token and forging that same token on the write connection.
• Allocate the target buffer first, then spray uid=1000 children (each calling capset to force a fresh cred, not a shared refcounted one) so creds land behind the buffer in the write's forward direction.
• Widen the offset sweep to avoid corrupting the link group's connection tree (smc_lgr_register_conn panics otherwise); the PoC stops at first success when a child polls its own euid to zero.

Preconditions / Affected

CAP_NET_ADMIN is required twice: to register the UEID that brings SMC-D up, and to install the NFQUEUE rule. This is what makes it LPE rather than the older malicious-VM model (which needed no victim-side privilege). Realistic because container runtimes and network daemons hold CAP_NET_ADMIN. Requires the dibs_loopback device, which is what moved this formerly mainframe-only code onto commodity x86.

What to do

Patch (approved to LKML 2026-07-07). Where patching lags, the exposure hinges on SMC-D being reachable: if dibs_loopback / SMC-D is not needed, blocking the module or the AF_SMC family removes the surface. Detection heuristics from the writeup: NFQUEUE rules on loopback SMC-D traffic, and processes holding CAP_NET_ADMIN registering SMC-D UEIDs.

Caveats

The 22% figure is with mitigations off and reflects a deliberately self-imposed constraint — proving LPE from the zero-write alone. XBOW states that adding a memory leak or the UAF chaining they intentionally avoided would make it far more reliable, and leaves that "as a challenge to the reader." So the low success rate is not a ceiling on the vulnerability's severity.