Loading story…
A local privilege-escalation flaw in the Linux entropy daemon haveged was disclosed as CVE-2026-41054, allowing unprivileged local users to interact with a root-running daemon over its abstract UNIX command socket and trigger privileged operations. The bug affects releases from 1.9.14 with command socket support enabled, with broader discussion noting the underlying logic error was introduced earlier in the 1.9.x series, and it was fixed in haveged 1.9.21. In socket_handler() in src/havegecmd.c, the daemon checked SO_PEERCRED and sent a negative acknowledgment to non-root callers, but failed to exit the function, so processing continued into privileged command handling and exposed commands such as MAGIC_CHROOT and MAGIC_CLOSE.
The issue was reported by Dirk Müller of SUSE and disclosed through SUSE Bugzilla and the oss-sec mailing list, where maintainers urged users to upgrade to 1.9.21 or remove haveged entirely. The fix added an explicit exit after the NAK response and moved credential validation ahead of command parsing as a defense-in-depth measure. Follow-up discussion on oss-sec argued that modern Linux kernels have reduced the need for entropy daemons like haveged, and that keeping such software installed can unnecessarily expand system attack surface.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat Bugzilla stated that Fedora and EPEL released fixed haveged packages for multiple supported releases in response to CVE-2026-41054, including a backported patch for EPEL 8. The advisory also reiterated that upstream had fixed the flaw in haveged 1.9.21.
Jiri Hladky publicly disclosed technical details of CVE-2026-41054 on oss-sec, explaining that socket_handler() failed to return after rejecting non-root callers. The disclosure described how unprivileged local users could send MAGIC_CHROOT or MAGIC_CLOSE commands to the root-running daemon.
SUSE published security advisories and released updated haveged packages for multiple openSUSE Leap and SUSE Linux Enterprise products in response to CVE-2026-41054. The Bugzilla entry tied the updates to the local privilege-escalation flaw in haveged's command socket handling.
Marcus Meissner disclosed on the oss-sec mailing list that a local root exploit in haveged had been fixed in release 1.9.21 and advised users to update or uninstall the software. The issue was identified as CVE-2026-41054.
The vulnerability was fixed in haveged version 1.9.21 by adding a return path after sending a NAK to unauthorized callers and moving the credential check before command parsing as defense in depth. Affected versions were described as 1.9.14 and later with command socket support.
SUSE published Bugzilla issue 1264086 for CVE-2026-41054, describing a missing exit after a permission check in haveged that could lead to root exploitation. This documented the vulnerability in SUSE's tracking system.
Dirk Müller of SUSE reported the privilege-escalation issue affecting haveged's command socket handling. The flaw was later tracked as CVE-2026-41054.
The vulnerable command socket logic was introduced in haveged version 1.9.3, where non-root callers could receive a NAK but execution continued into privileged command handling. This created the basis for a local root exploit via the daemon's abstract UNIX socket.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
12 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcebugzilla.redhat.com
Open sourceseclists.org
Open sourcebugzilla.suse.com
Open sourceopenwall.com
Open sourcesecurity-tracker.debian.org
Open sourcelists.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026