New CentOS 9 Vulnerability Allows Attackers to Escalate Privileges to Root

A newly identified privilege escalation flaw in CentOS Stream 9 has triggered significant security concerns within the Linux community.

The vulnerability, originating from a Use-After-Free (UAF) condition in the Linux kernel’s networking subsystem, allows a local user to escalate privileges to root.

The issue was spotlighted at the TyphoonPWN 2025 hacking competition, where it won first place in the Linux category.

Adding urgency, a Proof-of-Concept (PoC) exploit has been publicly released, enabling attackers to achieve full system compromise on vulnerable installations reliably.

cstatic s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch,
            struct sk_buff **to_free)
{
    // ...
    if (q->buffer_used > q->buffer_limit) {                 // [1] Check buffer limit
        u32 dropped = 0;
        while (q->buffer_used > q->buffer_limit) {
            dropped++;
            cake_drop(sch, to_free);                        // [2] Packet is DROPPED here
        }
        b->drop_overlimit += dropped;
    }
    return NET_XMIT_SUCCESS;                                // [!] Returns SUCCESS anyway
}

Root Cause in CAKE Scheduler

The flaw exists in the sch_cake (Common Applications Kept Enhanced) packet scheduler, a component responsible for managing network traffic shaping in the kernel.

The issue specifically lies in the cake_enqueue() function, which mishandles return codes during packet drops.

Under buffer pressure, CAKE discards packets using cake_drop(), yet incorrectly returns NET_XMIT_SUCCESS, indicating to upper layers that the packet was successfully queued.

When layered under a classful scheduler such as HFSC (Hierarchical Fair Service Curve), this misleading response causes inconsistencies in reference tracking.

As a result, HFSC may retain a pointer to deallocated memory, creating a dangling reference a classic UAF scenario.

Attackers can exploit this condition to manipulate heap memory and inject controlled data into freed blocks, eventually achieving arbitrary code execution within the kernel.

cvoid rop_chain(uint64_t* data){
    int i = 0;
    data[i++] = kbase + POP_RDI_RET;            // Prepare stack for payload
    data[i++] = kbase + PUSH_RDI_POP_RSP_RET;   // Stack pivot
    data[i++] = kbase + POP_RDI_RET;
    data[i++] = 0x782f706d742f;                 // String: "/tmp/x"
    data[i++] = kbase + POP_RSI_RET;
    data[i++] = kbase + MODPROBE_PATH;          // Overwrite modprobe_path
    data[i++] = kbase + MOV_RSI_RDI_RET;        // Execute write
    data[i++] = kbase + SWAPGS;                 // Restore user state
    data[i++] = kbase + IRETQ;                  // Return to user space
    // ... (Restore registers)
}

According to a detailed report by SSD Disclosure, the released PoC outlines a practical and consistent exploitation chain comprising three stages:

• KASLR Bypass: A prefetch-based side-channel technique helps determine kernel memory offsets, neutralizing kernel address space randomization.
• Heap Spraying: Attackers use continuous sendmsg() calls to fill the kernel heap with fake Qdisc objects, increasing the likelihood of reusing freed memory under controlled data.
• ROP Chain Construction: A tailored Return-Oriented Programming (ROP) payload overwrites the modprobe_path variable, prompting execution of a malicious script as root when triggered.

This exploit chain grants full privileged access on any unpatched CentOS 9 system where the CAKE scheduler module (sch_cake.ko) is loaded.

Despite the responsible disclosure occurring over 90 days ago, an official patch has yet to be issued. Red Hat’s vendor advisory lists the status as “fix in progress.” Administrators are urged to:

• Temporarily disable or blacklist the sch_cake module.
• Restrict access to traffic control (tc) utilities to trusted users only.
• Closely monitor kernel updates and subscribe to security advisories for new releases.

As of now, no stable kernel patch for CentOS Stream 9 has been released, leaving manual mitigations as the only line of defense.

With public exploit code circulating, immediate hardening is strongly advised for production systems.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.