CVE-2026-72018: how XBOW’s AI agent gained root on Linux by writing 16 zero bytes

XBOW researchers discovered CVE-2026-72018 in the Linux kernel and developed a working local privilege escalation (LPE) exploit. The AI agent performed most of the research and exploit development, but human intervention was required at three critical points.

The vulnerability affects the dibs_loopback driver, which enables SMC-D (Shared Memory Communications – Direct), a shared-memory communication technology originally associated with IBM Z mainframes, to operate over loopback on ordinary x86 Linux systems.

During connection establishment, smcd_conn_save_peer_info() reads dmbe_idx and dmbe_size from a peer-controlled CLC message and calculates the transmit offset: tx_off = bufsize peer_rmbe_idx The offset passes through smcd_tx_ism_write() and smc_ism_write() to dibs_lo_move_data(), where memcpy() writes to cpu_addr + offset without checking the destination buffer boundaries.

Because SMC-D loopback normally sends dmbe_idx = 0, XBOW used nftables NFQUEUE and libnetfilter_queue to intercept and modify CLC Accept/Confirm messages, including the necessary packet checksums. This triggered an out-of-bounds write of a 32-byte CDC header (struct smcd_cdc_msg). On a send-only connection, its final 16 bytes are reliably zero, giving the attacker a constrained zero-write primitive at offsets aligned to 16 KiB. Through heap grooming, XBOW positioned kernel cred structures in the overwrite path. The 16-byte write zeroed suid, sgid, euid, and egid, causing the kernel to treat the affected process as root. The exploit then used setresuid(0, 0, 0) to obtain a root shell. No additional memory disclosure or supporting vulnerability was required.

The demonstrated local attack requires CAP_NET_ADMIN to register the UEID needed for SMC-D and install the nftables NFQUEUE rule. An ordinary unprivileged user without this capability cannot reproduce the demonstrated exploit as described. The exploit succeeded in 22 out of 100 separate system boots on Ubuntu 24.04 with Linux 7.1.0-rc6 (x86-64). The experiment was conducted with all kernel mitigations disabled, so this success rate has not been established for standard hardened systems.

What Was the AI Agent’s Role? XBOW independently discovered and validated the vulnerability and performed most of the exploit development, but researchers intervened three times. First, the agent prematurely abandoned packet interception as too expensive and concluded that local exploitation was impossible. A human researcher directed it back to the MITM approach. Second, XBOW repeatedly confused the local exploit’s constrained 16-byte zero-write with a more powerful arbitrary-write primitive from an earlier VM-to-VM threat model. The researcher insisted on experimentally verifying the actual primitive. Third, the agent focused on creating a stronger primitive through reference-count corruption and a possible use-after-free. The researcher instructed it to pursue LPE using the existing zero-write alone; XBOW then independently identified cred as the target and completed the working exploit.

The vulnerability was reported to the kernel developers on June 19, 2026, the patch was approved on July 7, and the CVE was published on August 17.

Article: https://xbow.com/blog/no-time-to-pwn-cve-2026-72018