Add kernelCTF CVE-2026-23278_cos (#exp462)

[G0RiyA]

kernelCTF submission for CVE-2026-23278 (nf_tables catchall break-statement UAF).

Submission ID: exp462

Target: cos-121-18867.381.30

Note: vuln-verify CI fails because the fix commit (7cb9a23d7ae4) has not been backported to the 6.6 stable branch yet. It exists in v7.0-rc4 and was backported to v6.12.78+, but not to 6.6.x which COS-121-18867.381.30 is based on.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[matrizzo]

Hi, thanks for your submission.

This exploit needs to support the --vuln-trigger flag (https://google.github.io/security-research/kernelctf/rules.html#exploit). This should only trigger the bug on a KASAN kernel and nothing more (see the rules in the link). In addition to that it should get the size of msg_msg from kernelXDK

[G0RiyA]

Added --vuln-trigger support in the latest commits. It triggers the nft_map_catchall break-statement bug and causes a UAF write detectable by KASAN, without running the full exploit chain.

Regarding msg_msg size: MSG_MSG_SIZE (0x80) is the total allocation size used for heap spray targeting kmalloc-cg-128. The actual msg_msg header size is obtained from kernelXDK via target.GetStructSize("msg_msg") at line 698.