### CVE-2026-43074 LPE exploit for blazer-260705

> Warning
>
> This repository contains an experimental kernel exploit proof of concept. It may modify system files, affect device stability, cause crashes, corrupt data, or permanently damage the target system. Run it only on devices that you own or are explicitly authorized to test. Back up important data before running it. Use at your own risk.

This is a use-after-free in the Linux eventpoll loop-depth check. An `epitem` can remain visible to an RCU reader after its associated `struct eventpoll` has reached a zero reference count. The eventpoll object is freed immediately by `ep_free()`, while `ep_get_upwards_depth_proc()` can still obtain and use that object through the RCU-protected `epitem`.

> This bug is different from the "badepoll" bug.

The issue is assigned `CVE-2026-43074` and was fixed upstream by deferring the eventpoll free until an RCU grace period:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=07712db80857d5d09ae08f3df85a708ecfc3b61f

The tested Pixel kernel still calls `kfree(ep)` directly. We confirmed that a low-privileged local process can exploit this issue to escalate to root/kernel privileges on Pixel 10 Pro under Jul 05 release version.

Tested affected Android/Pixel build:

```text
Device: Pixel 10 Pro / blazer
Android release: 17
SDK: 37
Build fingerprint: google/blazer/blazer:17/CP2A.260705.006/15641320:user/release-keys
Kernel: Linux localhost 6.6.118-android15-8-g53e6e091166e-ab15266607-4k
Build date: Thu Apr 23 01:33:59 UTC 2026
Page size: 4096
Architecture: aarch64
```

Run the attached binary twice to get a root shell.

Success rate: >80%