Loading story…
Public proof-of-concept exploit code was released for DirtyDecrypt (CVE-2026-31635), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in rxgk_decrypt_skb() within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as /etc/shadow, /etc/sudoers, or SUID binaries to gain root. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with CONFIG_RXGK enabled, including Fedora, Arch Linux, and openSUSE Tumbleweed; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets.
At the same time, researchers disclosed PinTheft, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the RDS zerocopy send path and uses io_uring fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the rds kernel module being present or autoloadable; Arch Linux was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers released proof-of-concept exploit code for DirtyDecrypt, a recently patched Linux kernel local privilege escalation bug affecting systems with CONFIG_RXGK enabled, including Fedora, Arch Linux, and openSUSE Tumbleweed. The PoC demonstrated how a missing copy-on-write guard could be abused for root access and potentially container escape on vulnerable worker nodes.
Canonical said default Ubuntu installations are generally not vulnerable to PinTheft because the affected RDS module is not loaded by default, though systems that explicitly enable RDS can be exploited. It outlined affected Ubuntu releases, rated the issue CVSS 7.8/High with Ubuntu Priority Medium, and said fixes would be delivered through Linux kernel image packages.
v12-security publicly disclosed PinTheft, a Linux local privilege escalation exploit targeting a double-free/refcount bug in the RDS zerocopy send path. The disclosure said the issue was discovered by Aaron Esau, included a proof of concept and patch, and showed how io_uring fixed buffers could be used to overwrite page cache and gain root via a SUID binary.
A public post described a new Linux local privilege escalation issue called DirtyDecrypt or DirtyCBC, likely corresponding to CVE-2026-31635, and linked it to patch commits from April 8 and April 18, 2026. The author later updated the report to say the issue reproduced successfully on Fedora and mainline Linux after initially failing to reproduce it on tested distributions.
An upstream fix for the Linux kernel local privilege escalation vulnerability later tracked as CVE-2026-31635 (DirtyDecrypt/DirtyCBC) was quietly merged. The flaw is in the RxGK subsystem's rxgk_decrypt_skb() function and can enable page-cache or privileged memory corruption leading to root access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourceseclists.org
Open sourcecanonical.com
Open sourceseclists.org
Open sourceinfosec.exchange
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers publicly disclosed **Dirty Frag**, a Linux kernel local privilege escalation chain that can give an unprivileged local user immediate root access across major distributions. The disclosure said the issue combines flaws in the in-place decryption fast paths for **`esp4`**, **`esp6`**, and **`rxrpc`**, allowing page-cache corruption or plaintext exposure in externally backed paged fragments. Public write-ups and exploit repositories described two working paths: overwriting **`/usr/bin/su`** with a root shell via the ESP/XFRM stack, or corrupting **`/etc/passwd`** through RXRPC/RXKAD behavior so a UID 0 account can be used without a password. The bug was published without patches or CVE assignments after an embargo was reportedly broken, and exploit code was quickly made public through oss-sec, GitHub, and security forums. A related GitHub proof of concept, **Copy Fail 2: Electric Boogaloo**, tied the ESP path to the **`MSG_SPLICE_PAGES`** no-copy-on-write fast path and reported successful exploitation on Debian, Arch, Fedora, and newer Ubuntu releases, while noting older Ubuntu 22.04 kernels were not affected by that specific path. AlmaLinux said all supported releases were affected, issued patched kernels in testing by backporting the upstream ESP fix, and recommended temporary mitigations including blacklisting or unloading **`esp4`**, **`esp6`**, and **`rxrpc`** modules and dropping page cache if compromise is suspected.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 12, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026