linux

A nine-year-old race condition vulnerability named RefluXFS (CVE-2026-64600) in the Linux kernel's XFS filesystem allows local attackers to overwrite protected files and gain root privileges, affecting systems with reflink enabled on kernel versions 4.11 and later. The flaw bypasses standard security defenses and leaves persistent, undetectable on-disk changes, prompting urgent patching by vendors and users, with no current reliable mitigations besides immediate kernel updates and reboots.

https://www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability present in all major distributions since 2011, allowing an unprivileged local attacker to obtain a dangling pointer to kernel stack memory and execute a 97% stable privilege escalation and container escape. The flaw arises from a misuse of the remove_waiter() function in the rtmutex subsystem, causing a stack-use-after-free (UAF) condition that enables controlled writes to kernel memory, leading to function pointer hijacking and root access. The bug was patched in Linux 7.1 after fifteen years, and affected systems are urged to upgrade, with detailed technical analysis and an exploit demonstrating the multi-stage attack involving kernel stack reuse, ASLR leaks, and control flow hijacking.

https://nebusec.ai/research/ionstack-part-2/

Researchers disclosed two high-severity Linux kernel vulnerabilities that allow untrusted users to escalate privileges to root. One flaw, named Januscape (CVE-2026-53359), affects KVM virtualization and enables guest virtual machines to escape containment and execute code on the host, while the other, GhostLock (CVE-2026-43499), is a use-after-free bug in the futex priority-inheritance code enabling local root escalation. Google awarded $250,000 and $92,337 through its bug bounty program for these vulnerabilities, which have now been patched in the Linux kernel.

https://arstechnica.com/security/2026/07/high-severity-guest-vm-escape-is-1-of-2-linux-vulnerabilities-to-surface-this-week/

A newly disclosed Linux kernel vulnerability called DirtyClone (CVE-2026-43503) allows local users to escalate privileges to root by exploiting a flaw in the handling of cloned network packets that share file-backed memory. Attackers with CAP_NET_ADMIN can manipulate in-memory copies of privileged binaries without altering the disk files, evading detection and gaining root access once the binaries are executed. The Linux kernel patch fixing this issue was released in May 2026, and users are urged to apply updates or restrict unprivileged user namespaces to mitigate the risk.

https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html

A critical one-character use-after-free vulnerability (CVE-2026-23111) in the Linux kernel's nf_tables packet-filtering code enables local privilege escalation from an unprivileged user to root, including container breakout. The flaw, patched since February 2026, has publicly available exploits and affects distributions with nf_tables and unprivileged user namespaces enabled, requiring urgent kernel updates and reboots to mitigate risk. This issue is part of a recent surge in Linux local-root exploits, emphasizing the need to restrict unprivileged user namespaces until patches are deployed.

https://thehackernews.com/2026/06/one-character-linux-kernel-flaw-enables.html

A nine-year-old Linux kernel vulnerability (CVE-2026-46333) allows unprivileged users to execute commands as root on major distributions like Debian, Fedora, and Ubuntu. The flaw, discovered by Qualys, is rooted in the kernel’s __ptrace_may_access() function and can be exploited through various methods. It’s recommended to apply the latest kernel updates or use temporary workarounds to mitigate the risk.

https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html

Cybersecurity researchers have revealed a new Linux backdoor called PamDOORa, sold on a Russian cybercrime forum, which exploits Pluggable Authentication Modules (PAM) to steal SSH credentials and enable persistent access through a magic password and specific TCP port. Designed as a sophisticated post-exploitation tool with anti-forensic features, PamDOORa runs with root privileges to capture user credentials and tamper with authentication logs, representing an evolution in Linux PAM-based backdoors.

https://thehackernews.com/2026/05/new-linux-pamdoora-backdoor-uses-pam.html

The Copy.Fail vulnerability is a significant local privilege escalation flaw in the Linux kernel disclosed in April 2026, allowing attackers with limited access to escalate privileges to root by exploiting the kernel crypto API and splice() without modifying files on disk, thus evading detection. Affecting major distributions and shared infrastructure environments like Kubernetes, this vulnerability undermines isolation between users and containers, prompting urgent patch rollouts and discussions about new mitigation strategies such as emergency kernel “killswitches.”

https://www.schneier.com/blog/archives/2026/05/copy-fail-linux-vulnerability.html

A new local privilege escalation vulnerability called Dirty Frag has been discovered in the Linux kernel, enabling unprivileged users to gain root access across major Linux distributions by exploiting flaws in the xfrm-ESP and RxRPC subsystems. This deterministic and highly reliable exploit, which builds on vulnerabilities like Copy Fail and Dirty Pipe, affects systems including Ubuntu 24.04.4, RHEL 10.1, and Fedora 44, prompting advisories from multiple vendors and recommendations to block affected kernel modules until patches are fully available.

https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html