CVE-2026-36355: Realtek rtl819x Unprivileged Kernel Memory R/W Leading to LPE

CVE-2026-36355: Summary of Kernel Memory Read/Write Vulnerability in Realtek rtl819x Jungle SDK Vulnerability Overview CVE ID: CVE-2026-36355 CWE: CWE-782, CWE-787, CWE-200 Discovered by: Danil Gordeev Disclosure Date: 2026-05-03 Vulnerability Type: Unauthorized kernel memory read/write (via debug ioctl) Impact: Local users can read/write arbitrary kernel virtual memory, leading to privilege escalation to root Technical Details The vulnerability exists in the Wi-Fi kernel driver. Two unaccess-controlled IOCTLs are exposed: (0x89f5) and (0x89f6). The debug command set is unconditionally defined in (without ), meaning this vulnerability is present in all production builds. The exploit code automatically detects layout and location, allowing it to work across different kernel versions and OEM builds. Affected Scope Affected Products: Realtek rtl819x Jungle SDK kernel Wi-Fi drivers, all versions up to v3.4.14. Affected Modules: , , , , , etc. Affected Vendors: D-Link, TOTOLINK, Tenda, NEC, I-O DATA, Elecom, Buffalo, Humax, H3C, IP-COM, etc. Note: Verification must be performed for each product, as different vendors may use different code branches. Remediation Current Status: No fix available as of the disclosure date. Recommendation: Vendors should check the GPL source code of their products to confirm whether the affected driver is included and apply patches accordingly. Test Environment Device: Ortel 4G LTE CPE (OEM: MeiG Smart FORGE_SLT711) SoC: Qualcomm MDM9607, ARMv7 Cortex-A7 Kernel: Linux 3.18.48 Module: rtl8192se.ko Date: 2026-02-23 Exploit Code (kpwn.c) Key Features of the Exploit Code Runs under any non-privileged user without requiring root privileges. Automatically detects offsets (comm, cred, tasks, pid) by traversing . Automatically detects vulnerable interfaces by probing read primitives in . is readable with 44 IOCTL calls; with 7,600 IOCTL calls, it bypasses (full scan path). Unconditionally spawns a root shell in every test run.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-36355: Realtek rtl819x Unprivileged Kernel Memory R/W Leading to LPE

More from this source