Loading story…
Researchers disclosed CVE-2021-20226, a reference-counting bug in the Linux kernel's io_uring subsystem that can allow local privilege escalation to root. The flaw stems from io_uring worker threads retaining and later using a pointer to current->files without properly incrementing the files_struct reference count, creating unsafe conditions during asynchronous file-descriptor operations.
Technical analysis showed the bug can lead to a use-after-free involving struct file, particularly when fdget() does not increment a file object's reference count because files_struct->count equals 1 and a worker or calling thread closes the descriptor. Researchers said the issue affects newer Linux kernels that include io_uring, noted possible exploitation paths involving asynchronous workers, file-descriptor table reuse, and interaction with execve and privileged processes, and reported that the vulnerability was fixed by a kernel commit that correctly increments the files_struct reference count.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Flatt Security released a detailed write-up explaining the bug's root cause, exploitation conditions, and the kernel commit that fixed it.
Zero Day Initiative published a blog advisory describing CVE-2021-20226, a reference-counting bug in the Linux kernel io_uring subsystem.
The issue was fixed in the Linux kernel by commit 0f2122045b946241a9e549c2a76cea54fa58a7ff, which increments the files_struct reference count appropriately.
The vulnerability was reported to the vendor via the Zero Day Initiative and tracked as ZDI-2021-001.
Flatt Security researcher Shiga (@Ga_ryo_) discovered a reference-counting flaw in the Linux kernel io_uring subsystem that can lead to local privilege escalation to root under certain conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
flatt.tech
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-40047** is a use-after-free vulnerability in the Linux kernel's `io_uring` `IORING_OP_WAITID` operation. A low-privileged local attacker can race cancellation handling in `io_waitid_wait()` because a wait-queue entry may not be pruned after a successful return, permitting repeated callbacks, list corruption, a system crash, or potential privilege escalation. The flaw was introduced in Linux kernel 6.7. The issue is fixed in Linux kernel versions 6.12.53, 6.17.3, and 6.18-rc1; maintainers recommend upgrading to a current stable release rather than cherry-picking the patch. Red Hat rated the vulnerability 7.8 under CVSS v3.1 and released fixes for supported Red Hat Enterprise Linux 9 and 10 kernel streams, while the RHEL 9 `kernel-rt` stream remains affected.
Aug 25, 2026
**CVE-2023-1252** is a use-after-free flaw in the Linux kernel’s OverlayFS asynchronous I/O path that can be triggered when OverlayFS performs direct asynchronous reads against an underlying Ext4 filesystem. I/O completion on a separate thread can free the embedded `iocb` in `ovl_aio_req` before the lower filesystem returns from its read/write iterator, creating a system-crash and potential local privilege-escalation condition for low-privileged users. The upstream fix adds reference counting to `ovl_aio_req`, retaining the I/O control block until `vfs_read_iter()` or `vfs_write_iter()` returns. The affected OverlayFS AIO implementation was introduced in Linux 5.6, and the correction was backported to the stable 5.15 series. Red Hat rated the issue Moderate (CVSS 7.0), released fixes for affected RHEL 8 and RHEL 9 kernel streams, including applicable EUS and `kernel-rt` packages, and listed RHEL 6 and 7 as unaffected.
Aug 26, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026