CVE-2026-36355

Executive Summary

CVE-2026-36355 is a critical privilege escalation vulnerability in the Realtek rtl8192cd Wi-Fi kernel driver, part of the broader Realtek rtl819x Jungle SDK up to version 3.4.14B. The flaw allows any unprivileged process on a device running this driver to invoke the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) handlers, providing arbitrary kernel memory read/write capabilities. This effectively grants local attackers full kernel control—arbitrary code execution with highest privileges, credibility for anti-forensics, and the ability to install persistent rootkits. Affected targets include a broad array of Wi-Fi routers, access points, and IoT devices using the Realtek Jungle Software Development Kit (SDK) for their rtl819x Wi-Fi SoC line. The vulnerability is unpatched, has public exploit code, yet lacks an official CVE entry from MITRE, complicating the response landscape.

Technical Analysis

The root cause of CVE-2026-36355 is the unconditional compilation of the _IOCTL_DEBUG_CMD_ macro in the file 8192cd_cfg.h. This macro enables the write_mem (ioctl handler for command 0x89F5) and read_mem (ioctl handler for command 0x89F6) debug commands in production builds. The NVD description confirms these handlers perform "no access control checks"—meaning no privilege verification, no capability check, no UID/GID filtering, and no kernel-space validation of the calling process's identity.

The vulnerability resides in the ioctl dispatch logic of the rtl8192cd driver. The driver exposes a character device interface (typically /dev/rtl819x or /dev/wlan), where user-space applications pass ioctl command codes. The driver's rtl8192cd_ioctl function receives the command and routes it to specific handlers based on the ioctl number. Within this dispatch table, the _IOCTL_DEBUG_CMD_ block registers the write_mem and read_mem handlers without an accompanying capable(CAP_SYS_ADMIN), capable(CAP_SYS_RAWIO), or equivalent access-control wrapper. This is a classic case of debug functionality being enabled in production, coupled with an oversight in access control.

From a code-level perspective, a call into write_mem and read_mem performs essentially raw memcpy operations to and from kernel memory. The handlers take user-supplied addresses (no address-space validation) and copy the user-provided data to/from those addresses. Without validation, a user can:

• Overwrite kernel code pointers (e.g., function pointers in ops structures).
• Modify credential structures of privileged processes (e.g., set uid=0).
• Disable SELinux/AppArmor/other security modules by modifying kernel security hooks.
• Inject arbitrary shellcode into kernel memory and redirect execution.

The attack surface is the local ioctl interface. The driver is present in thousands of consumer and enterprise routers, access points, and smart-home hubs that source their Wi-Fi subsystem from Realtek's Jungle SDK. The severity is amplified by the fact that the debug macro is compiled unconditionally—this is not an optional configuration issue.

Exploitation Scenarios

Scenario: Local Privilege Escalation on a Realtek-Based Wi-Fi Router

1. Reconnaissance/Target Identification: An attacker identifies a target device running a Realtek rtl8192cd-based Wi-Fi driver. This is commonly accomplished via banner grabbing (e.g., via a web interface showing "Realtek" in the HTTP server header), or by the presence of known vendor devices. Once identified, the attacker establishes a low-privilege foothold on the device—often via an unrelated web application vulnerability (e.g., command injection in the router's admin CGI script) exposing a /bin/sh command shell as an unprivileged user.

2. Trigger/Weaponization: With a shell on the device, the attacker locates the ioctl device node. On many systems it's accessible at /proc/driver/rtl819x or /dev/wlan0. The attacker writes a small C program (or uses a shell script with ioctl() calls) that:

   • Opens the device file (e.g., open("/dev/wlan0", O_RDWR)).
   • Constructs an ioctl structure containing:
     • Command code: 0x89F5 (for write_mem).
     • Target address: 0x0 (or a known kernel symbol address; more on this later).
     • Data buffer: "\x00\x00\x00\x00" to test.
   • Invokes ioctl(fd, 0x89F5, &payload).

   For a write_mem exploit, the attacker targets kernel credential structure. Since kernel symbol addresses are often static and published for the router's firmware (many are busybox-based with wide availability of firmware images and GPL source tarballs), the attacker can use a known offset from the kernel base. For example, if the kernel's init_cred structure offset is known, the attacker can overwrite the uid and gid fields of the current process's credentials.

3. Payload/Execution: The attack payload is a crafted write_mem ioctl that overwrites the cred structure's uid, gid, suid, and sgid fields to 0. On Linux kernels with the typical struct cred layout, this is a 32-byte overwrite from a known address. The attacker computes the address of the current process's cred by reading /proc/self/stat or via the task_struct chain, which requires reading kernel memory—a task the read_mem handler performs with equal ease. In a more advanced execution, the attacker injects a kernel rootkit into an unused kernel code region (e.g., inside the rtl8192cd driver's .text area) that disables security checks (LSM hooks) and installs a hidden backdoor.

4. Post-Exploitation Impact: After successful credential overwrite, the process runs with root privileges. The attacker then:

   • Adds a persistent SSH backdoor (e.g., appends a public key to /etc/dropbear/authorized_keys).
   • Installs a kernel module or rootkit in flash memory for persistence across reboots.
   • Harvests Wi-Fi WPA2/3 keys, admin credentials, and any other secrets from memory via read_mem.
   • Uses the router as a pivot point for lateral movement into the internal network.

Scenario: Driver Debug Interface Exposed via Web Shell

In many consumer routers, the web management interface runs at root privileges via a CGI binary. If an attacker finds a command injection in the web UI (e.g., in the "network diagnostics" ping feature), the injected command is executed as root, which bypasses the need for the ioctl exploit. The true danger is when unauthenticated command injection yields a non-root shell (e.g., in a restricted /tmp sandbox) or when the attacker has only an unprivileged SSH user (e.g., a guest account). In those cases, CVE-2026-36355 becomes the privilege escalation bridge.

Impact Assessment

The business impact of CVE-2026-36355 is significant for any organization relying on Realtek rtl819x-based network appliances. The affected surface spans SOHO routers (e.g., numerous TP-Link, Netgear, D-Link models), enterprise access points, and industrial IoT devices that integrate the Jungle SDK. Since access cannot be remediated via patch, the vulnerable state is indefinite until vendor firmware updates.

Blast radius is local, but the local attacker is the privileged foothold typical of low-complexity web exploits on these devices. Because the driver exposes arbitrary kernel memory read/write with no integrity implications (no authentication requirement), a successful exploit yields:

• Full system compromise (root/kernel).
• Credential theft, network lateral movement, and data exfiltration.
• Persistent, stealthy rootkits that survive firmware re-flashing (if written to Wifi driver flash region).
• Potential adjacent-network attacks (the compromised router can sniff and inject into all LAN/WAN traffic).

CVSS score is N/A as of this writing. The EPSS score (0.00669) indicates a 48.4th percentile of known exploited CVEs—a moderate probability of real-world exploitation. The vulnerability is listed as "Public" PoC with exploit code available, but it's not on the CISA Known Exploited Vulnerabilities (KEV) list, and no threat actor campaigns have been announced.

Detection Guidance

Sigma Rule

title: Realtek rtl8192cd Driver Debug Ioctl (CVE-2026-36355)
id: 9e2f3a11-87f2-4f5a-9a10-2c45b6d7e8f9
status: experimental
description: Detects attempts to invoke the unauthenticated write_mem (0x89F5) or read_mem (0x89F6) ioctls on the Realtek rtl8192cd Wi-Fi driver.
author: vartersit.com
date: 2026/07/14
logsource:
    product: linux
    category: process_creation
detection:
    selection_dev:
        Image|endswith:
            - '/bin/bash'
            - '/bin/sh'
            - '/tmp/*
    selection_ioctl:
        CommandLine|contains|all:
            - '0x89F5'
            - '0x89F6'
            - 'rwmem'
            - 'memrw'
    condition: selection_dev and selection_ioctl
    falsepositives:
        - Legitimate hardware debugging tools run by vendors via SSH
        - Authorized kernel developers with root access
level: high

YARA Rule

rule realtek_rtl8192cd_debug_ioctl {
    meta:
        author = "vartersit.com"
        date = "2026-07-14"
        description = "Identifies binary code or shell commands targeting ioctls 0x89F5/0x89F6 for CVE-2026-36355"
        cve = "CVE-2026-36355"
    strings:
        $ioctl_write = { 0xF5 0x89 }  // ioctl command 0x89F5 (write_mem)
        $ioctl_read = { 0xF6 0x89 }   // ioctl command 0x89F6 (read_mem)
        $cmdline_dev = "/dev/wlan" ascii
        $cmdline_dev2 = "/dev/rtl819x" ascii
        $proc_drv = "/proc/driver/rtl819x" ascii
        $compile_macro = "_IOCTL_DEBUG_CMD_" ascii
        $header_file = "8192cd_cfg.h" ascii
    condition:
        any of them
}

Suricata IDS Rule

alert ip any any -> any any (msg:"ET EXPLOIT Realtek rtl8192cd Debug Ioctl Attempt (CVE-2026-36355)"; content:"|f5 89|"; depth:2; content:"|00 00 00 00|"; http.server; metadata: engine realtek, cve CVE-2026-36355, severity Critical; reference:url,vartersit.com/cve-2026-36355; reference:cve,CVE-2026-36355; classtype:attempted-admin; sid:2026363551; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.action == "exec" and process.args : ("*/ioctl", "*/rwmem", "0x89F5", "0x89F6") and process.parent.name : ("bash", "sh", "ash", "csh")]
  [file where event.action in ("open", "created") and file.path in ("/dev/wlan0", "/dev/rtl819x", "/proc/driver/rtl819x")]

Splunk SPL Query

index=linux earliest=-7d
| search command IN ("*ioctl*0x89F5*", "*ioctl*0x89F6*")
    OR file_path IN ("/dev/wlan", "/dev/rtl819x", "/proc/driver/rtl819x")
    OR (process IN ("*rwmem*", "*memrw*") AND dest_category IN ("network_device", "router"))
| stats count by host, user, process_name, file_path
| sort -count

Wazuh OSSEC Rule

<group name="realtek, kernel, ioctl,">
  <rule id="100535" level="12">
    <if_sid>100100</if_sid>
    <match>ioctl(</match>
    <regex>0x89F[56]</regex>
    <description>Unauthorized Realtek rtl8192cd debug ioctl (CVE-2026-36355)</description>
    <group>kernel,exploit,privilege_escalation,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
    <info>Use of write_mem/read_mem debug handlers with no privilege check</info>
    <url>https://vartersit.com/cve-2026-36355</url>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1. Immediate Mitigations

   • Restrict access to the character device node used by the driver (/dev/wlan0, /dev/rtl819x). Change device file permissions to root-only (chmod 600 /dev/wlan0 && chown root:root /dev/wlan0).
   • Disable debug modes entirely if possible at compile time. In custom firmware builds, ensure #define _IOCTL_DEBUG_CMD_ is commented out in 8192cd_cfg.h.
   • Remove unprivileged user accounts from the device's shell (disable SSH PubkeyAuth for non-root, restrict via PAM if present).
   • Network segmentation: place vulnerable devices off the critical VLAN; isolate from internal servers and client PCs.
   • Implement a firewall rule to block kernel modules loading and restrict /dev access via a custom LSM if firmware allows.

2. Patch/Upgrade Steps

   • No vendor patch exists at this time. Contact your device vendor (TP-Link, Netgear, etc.) for updated firmware that compiles out the _IOCTL_DEBUG_CMD_ macro or adds privilege checks.
   • Monitor Realtek's Jungle SDK release notes for a version > 3.4.14B that addresses this issue.
   • If running OpenWrt or custom firmware, apply an upstream patch manually: in 8192cd.c or the ioctl handler, add:

     if (!capable(CAP_SYS_ADMIN)) return -EPERM;
     

     at the top of write_mem and read_mem handlers.

3. Long-Term Hardening

   • Transition to alternative Wi-Fi SoC vendors for future purchases (e.g., Qualcomm, MediaTek) that sanitize ioctl handlers.
   • Maintain a centralized firmware inventory and upgrade pipeline for network appliances.
   • Enforce device-level monitoring: forward kernel logs, sysctls, and SSH session logs to a central SIEM to catch post-compromise behavior.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-36355 (Official CVE entry)
2. ExploitDB / PoC — https://www.exploit-db.com/exploits/51928 (Public exploit code for write_mem)
3. Realtek Jungle SDK — https://www.realtek.com/Download/List?cate_id=584 (Download page for Jungle SDK; verify version)
4. Researcher Analysis — https://blog.vartersit.com/cve-2026-36355-rtl8192cd-ioctl-analysis (Detailed blog with code-level explanation)
5. CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-36355 NOT on KEV as of 2026-07-14)

Threat Actor Campaigns: As of this report, no nation-state or APT group has publicly claimed use of CVE-2026-36355. However, given the ease of exploitation and the public PoC, we assess with moderate confidence that commodity botnets (e.g., Mirai variants, BASHLITE) will integrate this exploit in the near term, given the prevalence of Realtek-based IoT devices in botnet targeting.