Loading story…
A coordinated disclosure detailed a local privilege escalation flaw in the Nix and Lix package manager daemons that can let a local user execute arbitrary code as root in multi-user deployments. The primary issue, tracked as CVE-2026-44028, stems from unbounded recursion in the Nix Archive (NAR) directory parser running on a coroutine stack without a guard page, creating a stack-to-heap overflow condition that can lead to heap corruption. Exploitation requires access to the daemon interface, typically through allowed-users or trusted-users, and a crafted deeply nested NAR payload; the attack is considered most relevant where the daemon runs as root and user access is broadly permitted.
Maintainers released fixes across multiple supported branches, including Nix 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7, and Lix 2.93.4, 2.94.2, and 2.95.2. The patches add recursion depth limits, guard pages for coroutine stacks, bounds checks for file names and symlink targets, and worker crash limits intended to make ASLR brute forcing harder. The disclosure also distinguished this flaw from separate Nix issues, including CVE-2026-44029 / GHSA-gr92-w2r5-qw5p, and stated that Guix is not affected; remote substituters were described as a limited practical attack path because they cannot reliably generate enough attempts to exploit the bug.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The disclosure stated that Nix fixed the issue in versions 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7, while Lix fixed it in versions 2.93.4, 2.94.2, and 2.95.2. Upstream mitigations included recursion depth limits, guard pages for coroutine stacks, bounds checks, and a worker crash limit.
A coordinated disclosure described local privilege escalation vulnerabilities in the Nix and Lix daemon implementations that could let a local user with daemon access execute arbitrary code as the daemon user, typically root in multi-user installations. The Lix issue was identified as CVE-2026-44028, and the disclosure noted related but distinct Nix advisories and CVE-2026-44029.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **GNU Guix** and `guix-daemon` exposed systems to arbitrary file writes and possible privilege escalation through unsafe handling of substitutes and archive restoration. The most severe issue affected the `restore-file` logic used by `guix substitute`, where a path traversal flaw could let a malicious substitute server or a man-in-the-middle attacker write files outside the intended directory; on systems where `guix-daemon` runs with elevated privileges, that could lead to **root compromise**. Reports also cited insufficient validation of `narinfo` metadata and unsafe processing of attacker-controlled URLs, including `file://` URIs. The weaknesses extended beyond `guix substitute` to other Guix operations, including `guix offload`, `guix archive --extract`, `guix challenge`, `guix pull`, and `guix time-machine`, creating several paths for arbitrary overwrite or local privilege escalation depending on deployment. Updated Guix releases were issued to fix the flaws, and users were urged to upgrade both **Guix** and `guix-daemon`; where immediate patching was not possible, a temporary mitigation was to disable substitutes with: ```bash guix --no-substitutes ```
Jul 12, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026