Hey, it's Asim

CIFSwitch: a non-universal Linux local root vulnerability

Wed, 27 May 2026 00:00:00 +0000

TLDR: CIFSwitch (CVE-2026-46243) is a distro-specific Linux LPE found by harnessing LLMs into better multihop knowledge composition. Read on for affected distros, mitigations, and vulnerability details.

Background
#

In Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More), I’d mentioned how improving LLMs’ ability to compose existing knowledge is a promising avenue for unlocking “creative” – or at least non-trivial – vulnerability findings. Incidentally, among the latest slew of Linux LPEs, CopyFail stood out for – among other things – exquisitely composing several logic bugs, serving as a reminder of the massive potential value of the approach. Unfortunately, training a capable looped transformer to improve compositionality was a non-starter, so I started looking for harness-level improvements instead.

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)

Wed, 29 Apr 2026 00:00:00 +0000

TLDR: the grossly overengineered, self-orchestrating team of vulnerability-hunting agents detailed below has discovered 20+ CVEs over the past few months, including CVE-2026-31432 and CVE-2026-31433: two remote, unauthenticated OOB writes in the Linux kernel’s ksmbd. Read on for the details of the setup that achieved this, including – yes! – getting LLMs drunk.

Background
#

“LLMing” vulnerability research has been on my “Do Something About This” list since DARPA’s AIxCC and XBOW’s initial results. But back in 2023-24, models required a lot of harnessing to get anything useful, tool use was rudimentary, and the idea of squeezing as much code as I could into a model’s context – then triaging away the false positives – filled me with dread.

Spooler Alert: Remote Unauth'd RCE-to-root Chain in CUPS

Sun, 05 Apr 2026 00:00:00 +0000

TLDR: my self-orchestrating team of vulnerability hunting agents discovered two issues in CUPS, CVE-2026-34980 and CVE-2026-34990, chainable into unauthenticated remote attacker -> unprivileged RCE -> root file (over)write. See below for the prerequisites, details, and mitigation options.

Intro
#

CUPS is the standard way to do printing on Linux and other Unix(-like) systems. It’s been on my mind as a research target ever since doing incident response to Simone Margaritelli’s 2024 unauth’d RCE finding, where he chained several CUPS vulnerabilities into an unauth’d RCE as lp, the default CUPS service user.

Hey, it's Asim

CIFSwitch: a non-universal Linux local root vulnerability

Background #

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)

Background #

Spooler Alert: Remote Unauth'd RCE-to-root Chain in CUPS

Intro #

Background
#

Background
#

Intro
#