Loading story…
Qualys disclosed two local privilege escalation vulnerabilities that can be chained to obtain root on affected Linux systems: CVE-2025-6018 in the PAM configuration of openSUSE Leap 15 and SUSE Linux Enterprise 15, and CVE-2025-6019 in libblockdev reachable through udisks. The first flaw lets an unprivileged user logging in via sshd manipulate PAM environment variables through ~/.pam_environment, allowing the session to be treated by polkit as a physical allow_active user. The second flaw lets an allow_active user escalate to root by abusing udisks filesystem-resize operations, which cause libblockdev to temporarily mount an attacker-controlled XFS filesystem in /tmp without nosuid and nodev protections.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A technical blog post published on Ubuntu 24.04 explained D-Bus and Polkit internals and discussed security case studies including CVE-2025-23222 in dde-api-proxy and CVE-2021-3560 in Polkit. It also demonstrated practical abuse paths involving bus-name ownership and session context.
Qualys published an advisory describing CVE-2025-6018, a PAM/polkit local privilege escalation affecting openSUSE Leap 15 and SUSE Linux Enterprise 15, and CVE-2025-6019, a libblockdev issue exploitable via udisks. The advisory showed that chaining the two flaws can let an unprivileged local attacker gain root.
Qualys said it sent the advisory draft along with SUSE and Red Hat patches to the linux-distros list as part of coordinated disclosure. This expanded pre-release notification beyond the initial vendor contacts.
Qualys said it reported a draft advisory covering CVE-2025-6018 and CVE-2025-6019 to SUSE and Red Hat. This marked the start of coordinated disclosure with the affected vendors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026
Two vulnerabilities in **Sudo**—`CVE-2025-32462` and `CVE-2025-32463`—were disclosed as affecting a wide range of Unix and Unix-like platforms, including **RHEL**, **CentOS**, **AlmaLinux**, **openSUSE**, **Ubuntu**, **Fedora**, **Debian**, **Arch Linux**, **FreeBSD**, **NetBSD**, **Oracle Linux**, and **macOS Sequoia** for one of the issues. The more severe flaw, `CVE-2025-32463`, carries a **CVSS 9.3** rating and can allow local privilege escalation to **root** through Sudo’s `chroot`-related behavior, while `CVE-2025-32462` is a lower-severity issue tied to specific `sudoers` host-matching configurations that can still permit unauthorized command execution as root.
Jul 24, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026