Loading story…
Two vulnerabilities in the SELinux userspace utility seunshare 3.10 were disclosed and assigned CVE-2026-59676 and CVE-2026-59677. The first flaw is a symlink race in rm_rf() caused by openat() being used without O_NOFOLLOW, allowing an unprivileged local user to delete arbitrary root-owned files under certain conditions when seunshare is installed setuid-root. The second flaw affects killall(), where combining --kill with a user-supplied -Z SELinux context can let an unconfined user kill root-owned processes running in an unconfined context.
Researchers said the default targeted SELinux policy leaves interactive users in an unconfined domain rather than transitioning them into seunshare_t, giving the bugs practical root-like impact despite SELinux enforcement. Upstream fixed both issues in SELinux userspace utilities 3.11, including commit 38f0a4d9a and removal of the vulnerable --kill functionality in commit 572db2fa. The file-deletion issue was reproduced on openSUSE Tumbleweed with policycoreutils 3.10, while Fedora 44 appeared to have a backported fix for that flaw; the process-kill issue was reproduced on both openSUSE and Fedora 44.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A follow-up on oss-sec announced CVE assignment for the two seunshare vulnerabilities affecting release 3.10. CVE-2026-59676 covers the rm_rf() local file deletion vector, and CVE-2026-59677 covers the killall() process-kill vector.
A security review disclosed two local denial-of-service attack vectors in the setuid-root SELinux userspace utility seunshare version 3.10: a symlink race in rm_rf() and a process-kill issue in killall(). The disclosure noted the flaws could have root-like impact on systems using the default targeted SELinux policy because seunshare runs in an unconfined domain.
The disclosure reported that upstream had fixed both seunshare issues in SELinux userspace utilities version 3.11. One fix was made in commit 38f0a4d9a, and the vulnerable --kill functionality was removed in commit 572db2fa.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourcesecurity.opensuse.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-33909** ("Sequoia") is a local privilege-escalation flaw in the Linux kernel filesystem layer, caused by converting a `size_t` buffer length to a signed 32-bit integer. An unprivileged local user can build and mount a directory hierarchy whose path exceeds 1 GB, then read `/proc/self/mountinfo` to trigger a predictable 10-byte out-of-bounds write containing `//deleted` relative to a `vmalloc` buffer. Qualys demonstrated root compromise on default Ubuntu 20.04–21.04, Debian 11, and Fedora 34 Workstation systems. The vulnerability, introduced in Linux 3.16, can be exploited by corrupting a validated eBPF program and overwriting the kernel `modprobe_path`. Linux commit `8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b` mitigates the allocation issue by rejecting `seq_file` buffer requests larger than `MAX_RW_COUNT` before `kvmalloc`. Organizations should deploy kernel updates; disabling unprivileged user namespaces and unprivileged BPF can reduce exposure to the demonstrated exploit chain but does not remove the underlying defect.
Aug 28, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026
Qualys disclosed **CVE-2026-64600**, dubbed **RefluXFS**, a local privilege-escalation flaw in the Linux kernel's XFS filesystem that can let an unprivileged user gain full root access. The bug is a race condition in XFS reflink direct-I/O copy-on-write handling that allows protected root-owned files to be overwritten on disk, including `/etc/passwd` and SUID-root binaries, with changes persisting across reboots. Qualys said the flaw was introduced in Linux `4.11` and affects mainline and stable kernels where XFS is deployed with reflink enabled. The issue is considered broadly exposed because reflink has been the default for `mkfs.xfs` since 2019, and default installations of **RHEL-derived distributions**, **Oracle Linux**, **Amazon Linux**, and **Fedora Server** may be exploitable out of the box when using reflink-enabled XFS root filesystems. Qualys estimated more than **16.4 million systems** could be affected, published a working proof of concept and demonstration video, and said there are no reliable temporary mitigations beyond patching and rebooting. A fix was merged into the Linux kernel tree on July 16, 2026, and distributions are now backporting the patch.
Aug 25, 2026