Loading story…
Researchers disclosed CVE-2026-5140, a critical local privilege escalation chain in Pardus Linux that lets any unprivileged local user gain root access without authentication through the pardus-update package. The flaw carries a CVSS v3.1 score of 9.3 and was identified by security researcher Çağrı Eser (0xc4gr1). The issue combines three weaknesses: an overly permissive Polkit policy, a CRLF injection flaw in SystemSettingsWrite.py, and an untrusted search path issue in AutoAptUpgrade.py.
Attackers can exploit the chain by injecting a malicious APT source path, causing the system to install a crafted Debian package with elevated privileges, and then obtaining a root shell by setting the SUID bit on /bin/bash. The exposure is particularly serious because Pardus Linux, maintained by TÜBİTAK, is widely deployed across Turkish government, education, and enterprise environments, especially on shared or multi-user systems. Recommended mitigations include tightening Polkit rules to require administrator authentication, sanitizing carriage return and newline characters in user input, and restricting APT source paths to trusted directories.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly disclosed the Pardus Linux privilege escalation flaw, explaining that an unprivileged local user could inject a malicious APT source, install a crafted package as root, and obtain a root shell. The disclosure assigned the issue a CVSS 9.3 severity and recommended tightening Polkit rules, sanitizing CRLF input, and restricting APT source paths to trusted directories.
Security researcher Çağrı Eser documented a critical local privilege escalation chain in the Pardus Linux pardus-update package, later tracked as CVE-2026-5140. The chain combined an overly permissive Polkit policy, a CRLF injection flaw in SystemSettingsWrite.py, and an untrusted search path issue in AutoAptUpgrade.py to let a local user gain root access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecybersecuritynews.com
Open sourcenullsecurityx.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TUBITAK BILGEM's **Pardus Software Center** was disclosed with two high-severity vulnerabilities affecting versions prior to `1.0.3`, including a privilege-management flaw tracked as `CVE-2026-5141` and a path traversal issue tracked as `CVE-2026-5166`. The first bug was described as **improper access control**, **incorrect privilege assignment**, and **improper privilege management**, creating a condition that could allow hijacking of a privileged process; the affected range was later clarified as versions from `1.0.2` before `1.0.3`. The second flaw, `CVE-2026-5166`, was classified as **CWE-22: Improper Limitation of a Pathname to a Restricted Directory** and affects Pardus Software Center versions before `1.0.3`. Both CVEs carry high-impact `CVSS v3.1` ratings with vectors indicating low attack complexity and no required privileges, while requiring user interaction, and both reference advisories published by **USOM**, including `TR-26-0131` for the path traversal vulnerability.
Jun 29, 2026
A local privilege escalation flaw in **PackageKit** tracked as `CVE-2026-41651` allows an unprivileged user to exploit a time-of-check/time-of-use race condition and install or remove arbitrary packages with root privileges. The issue, dubbed **Pack2TheRoot**, affects PackageKit versions `1.0.2` through `1.3.4` and was discovered by Deutsche Telekom’s Red Team during research into Linux privilege-escalation paths. Researchers said exploitability was confirmed on default installations using both `apt` and `dnf` backends, including **Ubuntu, Debian, Rocky Linux, and Fedora**, indicating broad exposure across Linux distributions. PackageKit **1.3.5** fixes the vulnerability, and maintainers said Linux distributors were notified in advance so updates could be prepared before public disclosure. A GitHub Security Advisory, Telekom’s technical write-up, an `oss-sec` disclosure, and a Debian security update were released as patches became available, while some technical details were initially withheld to reduce the risk of immediate weaponization. Because the vulnerable code path dates back more than a decade, the flaw may affect a wide installed base on systems where PackageKit is present and unpatched.
Jul 23, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026