Loading story…
Security updates were released for the Linux utility needrestart to fix five local privilege escalation vulnerabilities — CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003 — that can let an authenticated local attacker execute code as root and take full control of affected systems. The bugs affect needrestart versions earlier than 3.8 and were disclosed by Qualys, with advisories warning that the package is installed by default on Ubuntu Server beginning with version 21.04.
The vulnerabilities include insufficient validation of the PYTHONPATH and RUBYLIB environment variables, a race condition involving crafted files, and improper input validation in the Perl library Modules::ScanDeps. Administrators were urged to upgrade to needrestart 3.8 immediately; where patching is not yet possible, guidance recommends disabling interpreter scanning in /etc/needrestart/needrestart.conf by setting:
$nrconf{interpscan} = 0;
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Splunk published a TTP detection analytic, "Linux Possible Privilege Escalation via PYTHONPATH," to identify creation of rogue importlib/__init__.so files outside standard library paths. The write-up explicitly cites exploitation of needrestart flaw CVE-2024-48990 as an example of how attackers can gain elevated code execution.
Security updates were released to fix the five needrestart privilege escalation vulnerabilities, and administrators were advised to upgrade to version 3.8. As a workaround where patching is not possible, interpreter scanning can be disabled via the needrestart configuration.
Qualys published details of five local privilege escalation vulnerabilities in the Linux utility needrestart: CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003. The issues affect versions earlier than 3.8 and can allow a local authenticated attacker to gain root-level code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcecsirt.sk
Open sourcequalys.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed four Linux local privilege-escalation vulnerabilities dubbed **DirtyAH6** (`CVE-2026-80844`), **PPPoEject** (`CVE-2026-81000`), **TUNderflow** (`CVE-2026-68121`), and **DiagSpill** (`CVE-2026-74469`). The flaws, identified through agentic vulnerability hunting, could allow a local attacker to obtain root-level privileges on affected Linux systems. Oracle Linux issued `ELSA-2026-500330` updates for Oracle Linux 7 and 8 systems running Unbreakable Enterprise Kernel packages, addressing all four CVEs. `CVE-2026-68121` carries a CVSS v2 score of 10.0, while `CVE-2026-74469` is rated high severity with low-privilege requirements; the vendor advisory reported no known exploits at publication. Organizations using affected UEK deployments should prioritize applying the available kernel updates and reboot systems into the patched kernel.
Sep 25, 2026
A local privilege-escalation flaw in the Linux entropy daemon **haveged** was disclosed as **CVE-2026-41054**, allowing unprivileged local users to interact with a root-running daemon over its abstract UNIX command socket and trigger privileged operations. The bug affects releases from `1.9.14` with command socket support enabled, with broader discussion noting the underlying logic error was introduced earlier in the `1.9.x` series, and it was fixed in **haveged 1.9.21**. In `socket_handler()` in `src/havegecmd.c`, the daemon checked `SO_PEERCRED` and sent a negative acknowledgment to non-root callers, but failed to exit the function, so processing continued into privileged command handling and exposed commands such as `MAGIC_CHROOT` and `MAGIC_CLOSE`. The issue was reported by Dirk Müller of SUSE and disclosed through SUSE Bugzilla and the **oss-sec** mailing list, where maintainers urged users to upgrade to `1.9.21` or remove haveged entirely. The fix added an explicit exit after the NAK response and moved credential validation ahead of command parsing as a defense-in-depth measure. Follow-up discussion on oss-sec argued that modern Linux kernels have reduced the need for entropy daemons like haveged, and that keeping such software installed can unnecessarily expand system attack surface.
Jun 29, 2026
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Aug 25, 2026