Loading story…
A race condition in the Linux kernel's copy-on-write memory handling, tracked as CVE-2016-5195 and widely known as Dirty COW, allowed local users to gain elevated privileges by exploiting a flaw in __get_user_pages() and related memory management logic. The bug affected a broad range of Linux systems and became notable because it could let an unprivileged attacker modify otherwise read-only mappings, opening a path to root-level compromise on vulnerable hosts.
The issue was addressed in the upstream Linux kernel with changes described as removing gup_flags FOLL_WRITE handling games from __get_user_pages(), a fix tied to the vulnerable code path in the kernel memory subsystem. Security teams were urged to prioritize kernel updates and remediation across servers, workstations, and embedded Linux deployments because successful exploitation required only local access and could undermine core host trust boundaries.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A Linux kernel commit titled "mm: remove gup_flags FOLL_WRITE games from __get_user_pages()" was published as the fix associated with Dirty COW (CVE-2016-5195). This commit represents the remediation event in the upstream kernel source tree.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026
**CVE-2022-3623** is a moderate-severity Linux kernel flaw in `follow_page_pte` within `mm/gup.c`. A race condition can poison a page-table entry, enabling a local, low-privileged attacker to trigger denial of service. The defect is classified as **CWE-123** (write-what-where condition), a memory-corruption weakness that can permit arbitrary memory modification and, in some cases, code execution or privilege escalation. The issue was fixed upstream in Linux 6.1-rc1. Red Hat released corrected `kernel` and `kernel-rt` packages for affected RHEL 8 and RHEL 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and RHEL 7 kernel variants were not affected. Red Hat assigned CVSS 3.1 score **5.8** and stated that no qualifying mitigation was available, making deployment of vendor updates the recommended remediation.
Aug 26, 2026
**CVE-2022-2959** is a Linux kernel race condition in the watch queue implementation that can allow a local, low-privileged attacker to escalate privileges or cause a denial of service. Missing synchronization in `pipe_resize_ring()` permits a process resizing a watch-queue pipe through `ioctl(IOC_WATCH_QUEUE_SET_SIZE)` to race with a `keyctl()`-triggered notification, resulting in access to a freed buffer. The flaw is categorized as **CWE-820: Missing Synchronization**, in which concurrent unsynchronized access to shared resources can produce an unexpected state and enable data disclosure, modification, or altered execution logic. Red Hat assigned CVSS 3.1 7.0 (`AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`); RHEL 6–8 are unaffected because they lack general notification queue support, while fixes were issued for affected RHEL 9 `kernel`, `kernel-rt`, and `kpatch-patch` packages.
Aug 26, 2026