kernelCTF: add CVE-2026-74753_lts

[nebusecurity]

No description provided.

[JordyZomer]

Hi @nebusecurity, thanks for the submission! A couple of notes from the first-stage verification:

Vuln-verify GHA failure: This is not a problem with your submission. The fix commit (fa091f46c383) hasn't been backported to the 6.12 stable branch yet in the kernel.dance database (the DB covers up to 6.12.99, and the fix should land in 6.12.106+). The upstream fallback also fails because it tries to build a v7.2-rc kernel with the 6.12 config, which doesn't work due to config incompatibility. We'll re-run once the 6.12 backport is available, or grant a manual exception. The --vuln-trigger implementation looks correct and exploit_repro passed at 99.3%.

kernelXDK AddSymbol() misuse: AddSymbol() must only be used for actual kernel symbols, entries that exist in kallsyms. The following are ROP gadgets, not kernel symbols, and should not be registered through AddSymbol():

target.AddSymbol("ret", 0x11274);              // not a symbol
target.AddSymbol("pop_rdi_ret", 0x9bafd);      // not a symbol
target.AddSymbol("pop_rsi_ret", 0x12bb09);     // not a symbol
target.AddSymbol("mov_qword_ptr_rsi_rdi_ret", 0x38256d); // not a symbol

Please use the built-in RopActionId variants instead, these are already available in the stock kxdb and don't require you to manually register gadgets at all. If a built-in action genuinely doesn't exist for your use case, keep gadget addresses as explicit #define constants (with comments) and pass them directly to rop.Add() rather than laundering them through the symbol API.

[nebusecurity]

Hi and thanks for the catch!

Gadget offsets seems indeed should not be registered through AddSymbol().

However since the public KXDB currently has no lts-6.12.101 target, so the exploit still needs a temporary fallback until its target-specific ROP actions become available.

We have removed the four pseudo-symbols. The exploit now uses the built-in RopActionId variants when KXDB provides them, and otherwise uses explicit, documented gadget offsets with rop.Add(). AddSymbol() is now only used for actual kernel symbols.