Loading story…
A new Linux kernel exploitation technique shows how the zero_pfn mapping can be abused to make dirty pagetable attacks more reliable and turn limited page-table corruption into local privilege escalation. The write-up says zero_pfn can disclose a kernel physical address, helping attackers bypass physical kASLR, and notes that on x86 Linux the Interrupt Descriptor Table (IDT) is mapped immediately after zero_pfn. That layout allows a partially corrupted page-table entry to be redirected into read-write access over the IDT, creating a path from memory corruption to kernel control.
The research further describes Interrupt Oriented Programming (IOP) as a way to gain kernel code execution by chaining fault and interrupt handlers instead of conventional ROP gadgets, including in environments protected by kPTI. It also outlines a SMAP bypass by preserving the AC flag when the usual interrupt prologue that executes clac is skipped. A related dirty pagetable reference provides background on the page-table overlap technique, while the newer research argues similar zero_pfn adjacency issues may also affect ARM systems through overlap attacks against kPTI trampoline mappings even without a physical memory leak.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A 2023 write-up discussed the Dirty Pagetable exploitation technique, which is later referenced as a basis for the zero_pfn-based Linux kernel exploitation approach.
A July 2025 blog post described abusing zero_pfn mappings to simplify dirty pagetable attacks, leak a kernel physical address to bypass physical kASLR, and turn partial page-table corruption into read-write access to the IDT for local privilege escalation. The post also introduced an Interrupt Oriented Programming approach and described a SMAP bypass and ARM-related implications.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing **x86 page-fault handling** logic flaw and newly optimized **page-cache side-channel** techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 `do_page_fault()` path could leave **hardware interrupts** enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into **Linux 6.19** with plans to backport to stable branches. Separately, researchers from Graz University of Technology described significantly faster Linux **page cache attacks**, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only **CVE-2025-21691** has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated **GPU DDK** issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers publicly disclosed **Dirty Frag**, a Linux kernel local privilege escalation chain that can give an unprivileged local user immediate root access across major distributions. The disclosure said the issue combines flaws in the in-place decryption fast paths for **`esp4`**, **`esp6`**, and **`rxrpc`**, allowing page-cache corruption or plaintext exposure in externally backed paged fragments. Public write-ups and exploit repositories described two working paths: overwriting **`/usr/bin/su`** with a root shell via the ESP/XFRM stack, or corrupting **`/etc/passwd`** through RXRPC/RXKAD behavior so a UID 0 account can be used without a password. The bug was published without patches or CVE assignments after an embargo was reportedly broken, and exploit code was quickly made public through oss-sec, GitHub, and security forums. A related GitHub proof of concept, **Copy Fail 2: Electric Boogaloo**, tied the ESP path to the **`MSG_SPLICE_PAGES`** no-copy-on-write fast path and reported successful exploitation on Debian, Arch, Fedora, and newer Ubuntu releases, while noting older Ubuntu 22.04 kernels were not affected by that specific path. AlmaLinux said all supported releases were affected, issued patched kernels in testing by backporting the upstream ESP fix, and recommended temporary mitigations including blacklisting or unloading **`esp4`**, **`esp6`**, and **`rxrpc`** modules and dropping page cache if compromise is suspected.
Sep 5, 2026