Loading story…
LACT version 0.10.0 contains two local vulnerabilities affecting its root-privileged GPU-control daemon. CVE-2026-75037 is a Polkit authorization bypass: the daemon authenticated clients by PID alone, allowing an eligible local user to win a PID race and add profile-hook scripts that the daemon would execute as root. The issue was compounded by related UID-handling behavior in zbus_polkit.
CVE-2026-75038 affects LACT's unauthenticated debug-snapshot API, which used predictable names for files written under /tmp. The condition could permit local denial of service and, on insufficiently hardened systems, permission-related information exposure or file-clobbering attacks; upstream changed snapshot creation from File::create to File::create_new to prevent overwriting an existing path. Upstream remediated both flaws in LACT 0.10.1; administrators should upgrade and restrict untrusted local access to affected systems until patched.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
A public report detailed the two LACT local vulnerabilities, including the unauthenticated snapshot API's predictable /tmp archive names and missing exclusive-create protections. It noted that common protected_symlinks and protected_regular kernel settings mitigate much of the temporary-file attack surface.
CVE identifiers CVE-2026-75037 and CVE-2026-75038 were assigned to LACT's Polkit PID-race authorization bypass and predictable temporary snapshot-file vulnerability, respectively.
Researchers reported two local LACT flaws to the project: a PID-based Polkit authorization race tracked as CVE-2026-75037 and predictable snapshot-file creation tracked as CVE-2026-75038. The former could allow eligible local users to arrange root-executed profile hooks, while the latter could enable file-clobbering conditions on insufficiently hardened systems.
CVE-2020-8908 was published for Guava Files.createTempDir(), which creates world-readable temporary directories on Unix-like systems and can expose data to other local users. The issue affects Guava versions 1.0 before 32.0 and is rated Low with a CVSS v3.1 score of 3.3.
Upstream addressed both LACT vulnerabilities in version 0.10.1, including a related zbus_polkit UID-handling issue. The snapshot fix replaced File::create() with File::create_new(), preventing creation over existing paths and symlink-following at the predictable snapshot location.
Oracle released its July 2021 Critical Patch Update with 342 new security patches across its product families. The update addressed numerous remotely exploitable, unauthenticated flaws, including several rated CVSS 9.8 to 10.0.
Google deprecated Guava's Files.createTempDir() beginning with Guava 30.0 and documented its world-readable temporary-directory behavior rather than changing it. It recommended Java NIO Files.createTempDirectory() or a securely permissioned java.io.tmpdir location as mitigations.
Apache fixed the insecure temporary-directory creation and race-condition vulnerability CVE-2020-17521 in Groovy 2.4.21, 2.5.14, 3.0.7, and 4.0.0-alpha-2. The flaw could expose or modify sensitive data in shared temporary directories and, where executable code was stored there, enable local privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
security.opensuse.org
Open sourcegithub.com
Open sourcecve.org
Open sourceoracle.com
Open sourceissues.apache.org
Open sourcegithub.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity Linux kernel local privilege escalation flaw, tracked as **CVE-2026-46215**, allowed unprivileged local users with access to a GPU **DRM render node** to gain **passwordless root**. The bug was a use-after-free race in `DRM_IOCTL_GEM_CHANGE_HANDLE` within the DRM GEM core, introduced in `v6.18-rc1` during AMD CRIU checkpoint/restore work. Researchers showed the issue could be triggered by racing `GEM_CHANGE_HANDLE` against `GEM_CLOSE`, enabling concurrent handle manipulation and object freeing from interfaces reachable through render-node permissions. Public exploit analysis and a GitHub proof of concept showed attackers could reclaim freed memory with `pipe_buffer` objects, leak a kernel pointer to bypass **KASLR**, set `PIPE_BUF_FLAG_CAN_MERGE` to sidestep the **Dirty Pipe** mitigation, and overwrite `/etc/passwd` through the page cache to remove the root password. The exploit reportedly succeeded on 99 of 100 test boots with fewer than 100 race attempts on average. The vulnerability was credited to **Puttimet Thammasaeng** and fixed in Linux `6.18.32`, `7.0.9`, and `7.1-rc3`, while maintainers also moved to disable the `GEM_CHANGE_HANDLE` ioctl in the upcoming `7.1` release because of this and related race conditions.
Jul 12, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026