linux

A nine-year-old Linux kernel vulnerability (CVE-2026-46333) allows unprivileged users to execute commands as root on major distributions like Debian, Fedora, and Ubuntu. The flaw, discovered by Qualys, is rooted in the kernel’s __ptrace_may_access() function and can be exploited through various methods. It’s recommended to apply the latest kernel updates or use temporary workarounds to mitigate the risk.

https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html

Cybersecurity researchers have revealed a new Linux backdoor called PamDOORa, sold on a Russian cybercrime forum, which exploits Pluggable Authentication Modules (PAM) to steal SSH credentials and enable persistent access through a magic password and specific TCP port. Designed as a sophisticated post-exploitation tool with anti-forensic features, PamDOORa runs with root privileges to capture user credentials and tamper with authentication logs, representing an evolution in Linux PAM-based backdoors.

https://thehackernews.com/2026/05/new-linux-pamdoora-backdoor-uses-pam.html

The Copy.Fail vulnerability is a significant local privilege escalation flaw in the Linux kernel disclosed in April 2026, allowing attackers with limited access to escalate privileges to root by exploiting the kernel crypto API and splice() without modifying files on disk, thus evading detection. Affecting major distributions and shared infrastructure environments like Kubernetes, this vulnerability undermines isolation between users and containers, prompting urgent patch rollouts and discussions about new mitigation strategies such as emergency kernel “killswitches.”

https://www.schneier.com/blog/archives/2026/05/copy-fail-linux-vulnerability.html

A new local privilege escalation vulnerability called Dirty Frag has been discovered in the Linux kernel, enabling unprivileged users to gain root access across major Linux distributions by exploiting flaws in the xfrm-ESP and RxRPC subsystems. This deterministic and highly reliable exploit, which builds on vulnerabilities like Copy Fail and Dirty Pipe, affects systems including Ubuntu 24.04.4, RHEL 10.1, and Fedora 44, prompting advisories from multiple vendors and recommendations to block affected kernel modules until patches are fully available.

https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html

A critical local privilege escalation vulnerability in the Linux kernel, named CopyFail (CVE-2026-31431), has been publicly disclosed with exploit code that easily grants root access across virtually all Linux distributions. The flaw affects multi-tenant servers, Kubernetes containers, and CI/CD workflows, posing a severe threat as attackers can escalate privileges quickly on vulnerable systems before widespread patches are applied. Security experts warn this is one of the most serious Linux vulnerabilities in years, urging immediate investigation and mitigation by Linux users and vendors.

https://arstechnica.com/security/2026/04/as-the-most-severe-linux-threat-in-years-surfaces-the-world-scrambles/