Loading story…
Security researchers and hardening vendors published a connected body of work showing how Linux kernel heap vulnerabilities can be turned into reliable exploitation primitives and how newer allocator-focused defenses aim to break those chains. Public research revisited CVE-2021-26708, including Alexander Popov's write-up on exploiting the bug and a later proof of concept demonstrating compromise through sshd, while additional analysis examined the msg_msg technique for kernel heap reconnaissance and the broader exploitation value of slab allocator behavior.
Follow-on defensive work focused on disrupting those memory-unsafety paths at the allocator level. grsecurity described AUTOSLAB as a change to the kernel heap security model, HardenedVault assessed SLUBStick risk for embedded systems, and later discussed VED and post-CFI data-oriented protections intended to reduce exploit reliability even when control-flow defenses are present. Together, the reports show a shift from documenting practical Linux kernel heap exploitation to deploying mitigations that target heap grooming, object reuse, and data-only attack techniques.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Researchers from Graz University of Technology presented Fence2Pwn, a Linux kernel exploitation technique that abuses KFENCE’s alternate allocation path to enable cross-cache reclamation of freed kernel memory. The work demonstrated controlled object overlap using synthetic tests and CVE-2023-52926 in io_uring, and noted that Linux kernel and Android mitigations were introduced after disclosure.
grsecurity published an article explaining how AUTOSLAB changes the memory unsafety landscape, adding a new technical development to the broader story.
A hardenedvault article titled "VED 2026: after CFI - data only" was published, documenting a further development in the VED security work.
Phrack issue 71 was published, providing a reference point for related technical research included in that issue.
A hardenedvault post published a proof of concept for exploiting CVE-2021-26708 against sshd, adding further technical detail to the vulnerability's exploitation story.
Alexander Popov published technical details on exploiting CVE-2021-26708 in the Linux kernel in a post titled "Four Bytes of Power: Exploiting CVE-2021-26708 in the Linux kernel."
A hardenedvault post assessed SLUBStick risk for embedded systems, contributing analysis of exploitation risk in that environment.
A hardenedvault article described the "msg_msg" exploit reconnaissance technique and its mitigation in VED, documenting a defensive development related to kernel exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcegrsecurity.net
Open sourcehardenedvault.net
Open sourcehardenedvault.net
Open sourcephrack.org
Open sourcehardenedvault.net
Open sourcehardenedvault.net
Open sourcea13xp0p0v.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Linux defenders are being urged to detect local privilege escalation through behavioral correlations rather than signatures for individual CVEs. Elastic’s framework combines endpoint and Auditd telemetry to identify unprivileged processes that reach UID 0 after executing from writable paths, invoking suspicious SUID/SGID binaries, manipulating user namespaces with `unshare`, abusing trusted helpers, or accessing privileged data. Testing covered 11 public proof-of-concept exploits and SUID misconfigurations, including page-cache corruption, D-Bus, namespace, and file-descriptor-theft techniques; the researchers caution that custom evasion-focused exploits may bypass coverage. The guidance follows active risk from page-cache vulnerabilities including **Copy Fail** (`CVE-2026-31431`), which is reported exploited in the wild and listed in CISA’s KEV catalog, and DirtyFrag. These flaws can modify cached readable files—including SUID binaries, `/usr/bin/su`, or `/etc/passwd`—to gain root, with suspicious socket, `splice()` and namespace activity providing detection opportunities. Defenders should patch affected kernels, consider restricting unprivileged user namespaces and relevant kernel modules after compatibility testing, and evict page cache after mitigation. They should also monitor `/proc/sys/fs/binfmt_misc` for new or changed handlers and attacker-controlled interpreters, as the `binfmt_misc` credentials flag can redirect a legitimate SUID program to a malicious handler that inherits root privileges without the handler carrying a SUID bit.
Sep 11, 2026
Security research highlighted a continued shift in attacker tradecraft toward **Linux cloud and container environments**, with stealth-focused malware increasingly abusing modern kernel capabilities. Elastic Security Labs documented the evolution of Linux rootkits from userland hijacking and LKM implants to newer generations that leverage **eBPF** and **io_uring** for stealth and evasion, citing examples including **TripleCross**, **Boopkit**, and **RingReaper**. Separately, reporting on **VoidLink** described a cloud-native malware framework designed to operate inside Linux workloads, detect whether it is running in major cloud providers and in **Docker/Kubernetes**, and adapt its behavior to remain persistent while harvesting sensitive material such as cloud metadata and credentials. Operationally, the same kernel features and observability gaps being leveraged by attackers are also driving defensive tooling improvements. Trail of Bits released *mquire*, an open-source Linux memory forensics tool intended to reduce dependency on external debug symbols by extracting structure and symbol information directly from memory using **BPF Type Format (BTF)** and **Kallsyms** (e.g., `/proc/kallsyms`-style data), then exposing findings through an interactive **SQL** query interface. While *mquire* is not tied to a single named campaign, it is directly relevant to investigating advanced Linux threats (including kernel-level implants and stealthy cloud malware) by enabling more reliable post-compromise analysis of Linux memory dumps across kernel versions.
Jul 12, 2026