Add kernelCTF CVE-2026-43499_lts_cos

pocs/linux/kernelctf/CVE-2026-43499_lts_cos/docs/vulnerability.md

@@ -0,0 +1,13 @@
+# Vulnerability Details
+
+- **Requirements**:
+    - **Capabilities**: None
+    - **Kernel configuration**: `CONFIG_FUTEX_PI=y`
+    - **User namespaces required**: No
+- **Introduced by**: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8161239a8bcc
+- **Fixed by**: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
+- **Affected Version**: `v2.6.39-rc1 - v7.1-rc1`
+- **Affected Component**: `kernel/locking/rtmutex.c`, futex PI requeue rollback path
+- **Syscall to disable**: `futex`
+- **Cause**: Use-After-Free / dangling pointer
+- **Description**: A Use-After-Free vulnerability was discovered in the Linux kernel's rtmutex priority inheritance logic. When `futex_requeue()` uses the proxy-lock path and `rt_mutex_start_proxy_lock()` has to roll back a waiter whose `waiter->task` is not `current`, the old `remove_waiter()` implementation updates `current->pi_lock` and `current->pi_blocked_on` instead of the real waiter task. This leaves a stale waiter in the target task's `pi_blocked_on` state. Later priority changes, for example through `sched_setattr()` on that task, can make rtmutex priority-chain adjustment follow this dangling waiter and crash or corrupt control flow.

pocs/linux/kernelctf/CVE-2026-43499_lts_cos/exploit/cos-121-18867.381.56/Makefile

@@ -0,0 +1,36 @@
+CXX      ?= g++
+CPPFLAGS ?= -Ikernel-research/libxdk/include
+CXXFLAGS ?= -std=gnu++17 -static -O0
+LDFLAGS  ?= -static -s -Lkernel-research/libxdk/lib
+LDLIBS   ?= -lkernelXDK
+
+TARGETS := exploit exploit_debug
+SRC     := exploit.c physmap_leak.cpp
+
+.PHONY: all prerequisites run clean
+
+all: prerequisites exploit
+
+prerequisites: target_db.kxdb kernel-research/libxdk/lib/libkernelXDK.a
+
+target_db.kxdb:
+	wget -O $@ https://storage.googleapis.com/kernelxdk/db/kernelctf.kxdb
+
+kernel-research:
+	git clone --depth 1 https://github.com/google/kernel-research.git $@
+
+kernel-research/libxdk/lib/libkernelXDK.a: | kernel-research
+	cd kernel-research/libxdk && ./build.sh
+
+exploit: prerequisites $(SRC)
+	$(CXX) $(CPPFLAGS) $(CXXFLAGS) $(SRC) -o $@ $(LDFLAGS) $(LDLIBS)
+
+exploit_debug: CXXFLAGS += -g
+exploit_debug: prerequisites $(SRC)
+	$(CXX) $(CPPFLAGS) $(CXXFLAGS) $(SRC) -o $@ $(LDFLAGS) $(LDLIBS)
+
+run: exploit
+	./$<
+
+clean:
+	rm -rf $(TARGETS) target_db.kxdb kernel-research