Loading story…
A high-severity Linux kernel local privilege escalation flaw, tracked as CVE-2026-46215, allowed unprivileged local users with access to a GPU DRM render node to gain passwordless root. The bug was a use-after-free race in DRM_IOCTL_GEM_CHANGE_HANDLE within the DRM GEM core, introduced in v6.18-rc1 during AMD CRIU checkpoint/restore work. Researchers showed the issue could be triggered by racing GEM_CHANGE_HANDLE against GEM_CLOSE, enabling concurrent handle manipulation and object freeing from interfaces reachable through render-node permissions.
Public exploit analysis and a GitHub proof of concept showed attackers could reclaim freed memory with pipe_buffer objects, leak a kernel pointer to bypass KASLR, set PIPE_BUF_FLAG_CAN_MERGE to sidestep the Dirty Pipe mitigation, and overwrite /etc/passwd through the page cache to remove the root password. The exploit reportedly succeeded on 99 of 100 test boots with fewer than 100 race attempts on average. The vulnerability was credited to Puttimet Thammasaeng and fixed in Linux 6.18.32, 7.0.9, and 7.1-rc3, while maintainers also moved to disable the GEM_CHANGE_HANDLE ioctl in the upcoming 7.1 release because of this and related race conditions.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was fixed in Linux versions 6.18.32, 7.0.9, and 7.1-rc3, and maintainers also disabled the GEM_CHANGE_HANDLE ioctl in the upcoming 7.1 release because of this and related races.
The flaw was first reported by Puttimet Thammasaeng, who received the official CVE credit and upstream reported-by attribution for the Linux kernel local privilege escalation issue.
The vulnerability CVE-2026-46215 was introduced in Linux kernel v6.18-rc1 as part of AMD CRIU checkpoint/restore work, creating a use-after-free race in DRM_IOCTL_GEM_CHANGE_HANDLE reachable via render nodes.
A public GitHub repository documented exploit analysis and proof-of-concept code for CVE-2026-46215, showing how an unprivileged user with render node access could gain passwordless root on vulnerable kernels.
Ubuntu published a CVE tracking page for CVE-2026-46215, indicating downstream vendor tracking of the Linux kernel vulnerability.
A Linux kernel commit updated drm_gem_change_handle_ioctl to use safer IDR allocation and replacement logic while holding the relevant locks, preventing incorrect object mapping during GEM handle changes. The patch reflects an upstream code-level fix or hardening step for the race condition later tracked as CVE-2026-46215.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
11 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegithub.com
Open sourcecyberstan.co.uk
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcesecurity-tracker.debian.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-51043** is a use-after-free flaw in the Linux kernel DRM atomic modesetting subsystem. A local low-privileged attacker can race a nonblocking atomic display commit against unloading or removing a graphics driver, allowing the asynchronous commit to outlive the `drm_device` reference inherited from its ioctl context. Successful exploitation can cause denial of service or potentially local privilege escalation; Red Hat assigns a CVSS v3.1 score of 7.0. The issue affects kernels before version 6.4.5 and was fixed upstream in commit `4e076c73e4f6e90816b30fcd4a0d7ab365087255`, which makes each `drm_atomic_state` retain a `drm_device` reference until the atomic state is freed. Red Hat identified affected RHEL 8 and 9, including selected Extended Update Support, real-time kernel, and Red Hat Virtualization releases, and issued kernel updates. Organizations should deploy the applicable kernel updates; where patching is not immediately possible, Red Hat recommends preventing the DRM kernel module from loading.
Aug 26, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026