工具介绍

多架构权限升级工具包，包含29个漏洞利用（amd64为预构建，其他架构在运行时通过gcc编译）。支持 amd64、arm64、386、mips、mipsle、mips64 和 mips64le。检测内核版本，过滤已补丁的漏洞利用，并依次尝试每个漏洞，直到获得根权限。
项目地址：https://github.com/portbuster1337/lpe-toolkit
## Exploits

[](https://github.com/portbuster1337/lpe-toolkit#exploits)

| #  | Name                          | Target                                       | Type                |
|----|-------------------------------|----------------------------------------------|---------------------|
| 1  | Copy Fail CVE-2026-31431      | AF_ALG + splice page-cache write             | pre-built / compile |
| 2  | Dirty Frag CVE-2026-43284     | xfrm-ESP/RxRPC page-cache write              | pre-built / compile |
| 3  | Fragnesia CVE-2026-46300      | espintcp splice page-cache corruption        | pre-built / compile |
| 4  | DirtyDecrypt CVE-2026-31635   | rxgk pagecache write                         | pre-built / compile |
| 5  | Fragnesia v2                  | skb_segment GRO coalesce                     | pre-built / compile |
| 6  | PinTheft                      | RDS zerocopy + io_uring page-cache overwrite | pre-built / compile |
| 7  | Dirty Pipe CVE-2022-0847      | /etc/passwd page-cache overwrite             | pre-built / compile |
| 8  | CIFSwitch CVE-2026-46243      | cifs.spnego + NSS namespace confusion        | pre-built / compile |
| 9  | PwnKit CVE-2021-4034          | pkexec environment escape                    | pre-built / compile |
| 10 | OverlayFS CVE-2021-3493       | user-ns mount escape                         | pre-built / compile |
| 11 | OvFS+FUSE CVE-2023-0386       | FUSE mount escape                            | pre-built / compile |
| 12 | Pack2TheRoot CVE-2026-41651   | PackageKit D-Bus race → setuid root          | pre-built / compile |
| 13 | Polkit D-Bus CVE-2021-3560    | accounts-daemon race                         | pre-built / compile |
| 14 | Docker Socket                 | writable /var/run/docker.sock                | pre-built / compile |
| 15 | netfilter OOB CVE-2021-22555  | ip_tables corruption                         | pre-built / compile |
| 16 | nft UAF2 CVE-2022-2586        | nftables chain UAF                           | pre-built / compile |
| 17 | pidfd race CVE-2026-46333     | ssh-keysign/shadow FD theft                  | pre-built / compile |
| 18 | CPU Timer Race CVE-2025-38352 | POSIX timer race (PoC)                       | pre-built / compile |
| 19 | nft UAF CVE-2024-1086         | Notselwyn multi-file nftables                | pre-built / compile |
| 20 | PEdit COW CVE-2026-46331      | tc-pedit page-cache overwrite su             | pre-built / compile |
| 21 | DirtyClone CVE-2026-43503     | ESP-in-UDP TEE page-cache passwd             | pre-built / compile |
| 22 | Bad Epoll CVE-2026-46242      | epoll close-vs-close race UAF                | pre-built / compile |
| 23 | FUSE OOB CVE-2026-31694       | FUSE readdir cache OOB -> passwd             | pre-built / compile |
| 24 | RefluXFS CVE-2026-64600       | XFS reflink CoW race -> passwd overwrite     | pre-built / compile |
| 25 | CrackArmor CVE-2026-23268+    | AppArmor confused-deputy -> sudo root        | pre-built / compile |
| 26 | skb_shift CVE-2026-43503      | TCP SACK flag loss -> ESP page-cache su      | pre-built / compile |
| 27 | GRO Flag Loss CVE-2026-43503  | GRO coalesce flag loss -> ESP page-cache su  | pre-built / compile |
| 28 | snap-confine CVE-2026-8933    | set-cap race -> udev rule -> setuid bash     | pre-built / compile |
| 29 | GTFOBins                      | 80+ passwordless sudo techniques             | go-handler          |

Linux多架构权限提升工具