Linux Kernel Bridge Subsystem Hit by Use-After-Free Vulnerability A recently disclosed proof-of-concept (PoC) exploit highlights a critical use-after-free flaw in the Linux kernel’s bridge subsystem, specifically within its Spanning Tree Protocol (STP) implementation. The vulnerability, tracked in the `net/bridge` component, arises when STP timers remain active after their associated bridge network device is deleted, leading to a memory-safety risk in the `kmalloc-cg-8k` slab cache. The issue manifests when kernel STP is enabled on an administratively down bridge, and a bridge port transitions to the LEARNING state. Under these conditions, the kernel may arm periodic STP timers such as `hello_timer`, `tcn_timer`, and `topology_change_timer` without verifying the `IFF_UP` interface flag. These timers, stored in the `struct net_bridge` structure, are tied to the bridge’s `net_device` private data. If the timers persist after the device is freed, subsequent callback execution via stale memory references can trigger a use-after-free condition. The root cause lies in inconsistent cleanup behavior between interface shutdowns and direct bridge deletions. During a standard UP-to-DOWN transition, the `ndo_stop` path invokes `br_stp_disable_bridge()`, which synchronously cancels STP timers using `del_timer_sync()`. However, deleting a bridge via the `delink` path or unregistering a downed interface bypasses this cleanup, leaving armed timers attached to a per-CPU timer base. When the kernel’s timer processing routine later attempts to execute these dangling timers in softirq context, it risks dereferencing freed memory. Researchers warn that controlled reallocation of the freed slab object could escalate the flaw into a control-flow hijacking primitive, extending its impact beyond crashes or denial-of-service (DoS) scenarios. The public PoC demonstrates the vulnerability’s lifecycle, emphasizing the need for prompt remediation in environments where bridge configurations are dynamic. A patch addressing the issue was introduced in Linux kernel commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems running earlier kernel versions are considered vulnerable and should be updated through their distribution’s supported packages. Until patches are applied, administrators are advised to restrict untrusted users from creating, modifying, or removing bridge interfaces and to audit workloads leveraging kernel STP.

Critical 18-Year-Old Linux Kernel Flaw (CVE-2026-64564) Enables Root Access and Container Escapes A severe use-after-free vulnerability in the Linux kernel, dubbed SCTPhantom (CVE-2026-64564), has been disclosed, allowing attackers with unprivileged local access to escalate to root privileges or escape containers to compromise the host system. The flaw, introduced in Linux 2.6.25 (December 2007), remained undetected for nearly 18 years before its discovery. The bug resides in the SCTP Dynamic Address Reconfiguration feature, specifically in how the kernel processes ASCONF chunks a mechanism defined in RFC 5061 for managing network paths in SCTP associations. The vulnerability stems from an identity mismatch in address validation: while the kernel checks a DEL-IP operation using the packet’s source address, a cached pointer relies on the address parameter tied to the actual network path. By crafting a malicious ASCONF sequence (e.g., adding, deleting, and then wildcard-deleting an address), attackers can force the kernel to dereference freed memory, triggering a use-after-free condition. Researchers at TencentOS Security Team, leveraging their Corvus AI autonomous vulnerability research system, developed a full privilege-escalation exploit chain. The attack begins by reclaiming the freed memory via a packet socket ring buffer, leaking a kernel memory address to bypass KASLR (Kernel Address Space Layout Randomization). A second use-after-free, combined with SCTP authentication key manipulation, constructs a fake kernel object graph, ultimately executing commit_creds to grant root access all without traditional shellcode or ROP chains. The exploit also enables container-to-host escapes, bypassing default seccomp profiles by leveraging per-socket SCTP options instead of system-wide sysctls. Testing across Ubuntu 24.04, Debian 13, Rocky Linux 9, and kernels from 5.14 to 7.2, the attack succeeded in all environments, including six of eight container escape attempts. With a CVSS v4.0 base score of 8.5 (High), the flaw poses significant risk due to its low attack complexity and severe impact on confidentiality, integrity, and availability. A patch (commit 9b245f86f0b) was merged upstream, rejecting DEL-IP requests targeting transports still referenced by active ASCONF chunks. Fixes have been backported to stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6), and CVE-2026-64564 was formally announced on August 4, 2026, following private disclosure on July 12. Systems running SCTP-enabled kernels, particularly in multi-tenant or containerized environments, are urged to apply updates immediately.

Linux Kernel FUSE Vulnerability (CVE-2026-31694) Enables Local Privilege Escalation A critical vulnerability in the Linux kernel’s FUSE (Filesystem in Userspace) subsystem, tracked as CVE-2026-31694, allows local attackers to escalate privileges to root by exploiting a flaw in directory entry caching. The issue stems from the `fuse_add_dirent_to_cache()` function, which fails to validate whether a directory entry exceeds the size of a single memory page before copying it into the cache. On systems with 4 KiB memory pages, a malicious FUSE server can return a directory entry sized at 4,120 bytes 24 bytes larger than a single page. When the kernel attempts to cache this entry, the overflow corrupts adjacent memory. Researchers demonstrated that this corruption can overwrite cached bytes from SUID binaries, such as `/usr/bin/su`, with malicious payloads that execute `setuid(0)` and `setgid(0)`, bypassing authentication and granting a root shell. The attack requires local access and the ability to mount or interact with a FUSE filesystem, which may be possible via unprivileged user namespaces or `fusermount3`. The vulnerability affects newer kernels with large readdir buffers but is limited to systems using 4 KiB page sizes; larger page configurations are unaffected. A patch has been released to reject oversized directory entries before caching. Mitigation options include restricting FUSE usage, removing the setuid bit from `fusermount3`, and limiting unprivileged namespaces. The flaw underscores the risks of kernel-level caching mechanisms in privileged operations.

Critical Linux Kernel Vulnerability (CVE-2026-46316) Exposes KVM/ARM64 Hosts to Guest-to-Host Escape A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-46316, a severe Linux kernel vulnerability dubbed "ITScape" that enables guest-to-host escape in KVM/ARM64 virtualization environments. Discovered by security researcher Hyunwoo Kim (V4bel), the flaw allows a malicious guest virtual machine (VM) to execute arbitrary commands on the host system with root-level kernel privileges. The vulnerability resides in the vGIC-ITS (Virtual Generic Interrupt Controller – Interrupt Translation Service) emulation logic within the Linux kernel’s KVM implementation. A race condition in the code leads to a "double-put" scenario, enabling host kernel code execution without requiring interaction with user-space components like QEMU. Unlike traditional VM escape flaws, ITScape operates entirely within the kernel, making it particularly dangerous successful exploitation grants direct kernel access rather than just user-space compromise. The PoC, released on GitHub, demonstrates how a crafted guest VM performing specific GIC/ITS memory-mapped I/O (MMIO) operations can trigger the race condition, escape the virtualized environment, and execute code on the host. Exploitation is confirmed by the creation of a root-owned file (`/ITScape`) on the host system. The PoC is designed for controlled testing using QEMU TCG to emulate ARM64 systems and is built atop Linux KVM self-tests. The flaw affects Linux kernel versions between commits `8201d1028caa` (April 2024) and `13031fb6b835` (June 5, 2026), prior to the patch. While the PoC is not fully weaponized for real-world cloud attacks, the researcher notes that adapting it for production environments would be feasible with adjustments to kernel configurations and memory layouts. The vulnerability poses a major risk to multi-tenant cloud environments, particularly those running ARM64 infrastructure, as it undermines virtualization isolation. Successful exploitation could enable lateral movement, data exfiltration, or full infrastructure compromise. The disclosure followed a coordinated embargo via the Linux-distros security mailing list, and patches have since been released to mitigate the issue. Organizations are urged to update affected kernels and audit virtualization environments for exposure.

New "PinTheft" Linux LPE Vulnerability Exposes Systems to Root Access Exploits A proof-of-concept (PoC) exploit has been released for PinTheft, a newly disclosed Linux Local Privilege Escalation (LPE) vulnerability that allows attackers to gain root-level control of affected systems. The flaw resides in the Reliable Datagram Sockets (RDS) zerocopy send path, specifically within the `rds_message_zcopy_from_user()` function, which improperly pins user pages during execution. This vulnerability highlights persistent security risks in Linux kernel networking and asynchronous I/O subsystems, where flaws can enable attackers to escalate limited local access to full administrative privileges. The release of public exploit code increases the urgency for patching, as LPE vulnerabilities are particularly dangerous once weaponized. PinTheft joins a recent surge of Linux kernel vulnerabilities, underscoring the ongoing challenges in securing complex kernel-level components. Organizations running affected Linux systems should prioritize updates to mitigate potential exploitation.

Critical Linux "Dirty Frag" Vulnerability Grants Root Access Across Major Distributions A newly disclosed Linux vulnerability, dubbed Dirty Frag, allows attackers to escalate privileges to root on nearly all major distributions, with a public proof-of-concept (PoC) exploit already circulating. The flaw, part of the same class as Dirty Pipe and Copy Fail (CVE-2026-31431), targets the `frag` member of the kernel’s `struct sk_buff`, enabling stable exploitation without race conditions. The attack leverages the zero-copy send path, where `splice()` inserts a reference to a read-only page cache page (e.g., `/etc/passwd` or `/usr/bin/su`) into the `frag` slot of a sender-side socket buffer (skb). Unlike previous vulnerabilities, Dirty Frag does not rely on timing-based conditions, making it highly reliable for achieving root access. Immediate mitigation steps include blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules and clearing page caches (`echo 3 > /proc/sys/vm/drop_caches`) to purge potentially compromised binaries from memory. While upstream patches are pending, organizations are advised to apply these workarounds to reduce exposure. The vulnerability affects a broad range of Linux systems, underscoring the urgency of addressing kernel-level flaws in enterprise and cloud environments. The public availability of the PoC increases the risk of widespread exploitation.

Linux Kernel Vulnerability "Copy Fail" Exploited in the Wild, CISA Warns The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert about active exploitation of CVE-2026-31431, a critical Linux kernel vulnerability dubbed Copy Fail. The flaw, present in all Linux distributions since 2017, allows authenticated attackers with code execution privileges to escalate to root access by manipulating the kernel’s AEAD template. Disclosed on April 29, the bug was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on Friday, with federal agencies directed to patch within two weeks. While exploitation remains limited primarily involving proof-of-concept (PoC) testing Microsoft warns of its broad applicability and the release of a working exploit, heightening risks for defenders. The vulnerability enables full root privilege escalation, posing severe threats to confidentiality, integrity, and availability. Attackers can leverage it for container breakout, multi-tenant compromise, and lateral movement in shared environments. Its stealthy in-memory exploitation and cross-platform compatibility make it particularly dangerous in cloud, CI/CD, and Kubernetes setups, where untrusted code execution is common. Exploitation requires only local, unprivileged access and can be chained with SSH, malicious CI jobs, or container access to achieve root shell. An attack typically begins with reconnaissance to identify vulnerable kernels, followed by a script to overwrite in-memory data and escalate privileges. Microsoft advises organizations to prioritize patching, isolate vulnerable systems, enforce access controls, and monitor logs for signs of compromise. The flaw’s decade-long presence underscores the ongoing risks of long-undetected kernel vulnerabilities in critical infrastructure.

Linux Kernel Privilege Escalation Flaw (CVE-2026-46215) Patched After Exploit Demo A critical use-after-free vulnerability in the Linux kernel, tracked as CVE-2026-46215, allowed local users with GPU render node access to escalate privileges to root without special permissions. The flaw affected mainline kernels from v6.18-rc1 until a patch was released in late May 2026, following a report to [email protected] on 12 April 2026. The bug resided in the DRM GEM core ioctl (DRM_IOCTL_GEM_CHANGE_HANDLE), introduced in v6.18-rc1 for AMD’s CRIU checkpoint/restore functionality. The ioctl moved a graphics buffer object between handles but failed to update its handle_count, creating a race condition. During a brief window, the object had two IDR (ID lookup) entries while its count remained at 1. If a second thread called DRM_IOCTL_GEM_CLOSE on the old handle, it would free the object while the new handle still referenced it. Since both ioctls carried the DRM_RENDER_ALLOW flag, any process with access to /dev/dri/renderD granted by default to logged-in users via systemd-logind* could trigger the race. ### Exploit Chain to Root Cyberstan’s proof-of-concept demonstrated how the flaw could be weaponized: - Memory reclamation via sprayed pipe_buffer structures. - Kernel pointer leak to bypass KASLR. - PIPE_BUF_FLAG_CAN_MERGE manipulation to circumvent the 2022 DirtyPipe fix. - /etc/passwd overwrite via page cache, removing root’s password field. The exploit succeeded in 99 out of 100 test boots, requiring fewer than 100 race iterations on average. ### Discovery & Fix Researcher Puttimet Thammasaeng initially reported the bug, receiving official CVE credit. A separate analysis by another researcher contributed additional exploit research. AMD’s David Francis and kernel maintainer Dave Airlie implemented a fix using a two-stage idr_replace operation to close the race window. For long-term mitigation, the GEM_CHANGE_HANDLE ioctl was disabled entirely in the upcoming 7.1 release, removing the vulnerable code path. Fixed kernel versions include 6.18.32, 7.0.9, and 7.1-rc3 onward. The vulnerability highlights a recurring issue in kernel development: compound operations on refcounted objects where references are added, removed, and counted in separate steps, leaving gaps for concurrent teardown to free memory still in use. Subsystems bypassing established helper functions remain at risk for similar race conditions.

Critical 15-Year-Old Linux Kernel Vulnerability "GhostLock" Disclosed Researchers at Nebula Security have uncovered GhostLock (CVE-2026-43499), a severe privilege escalation and container escape vulnerability in the Linux kernel, present since version 2.6.39 (released in 2011). The flaw, patched in April 2026, stems from a stack-based use-after-free (UAF) error in the kernel’s real-time mutex (rtmutex) subsystem, specifically in the `remove_waiter()` function during priority inheritance (PI) futex operations. The vulnerability arises when the kernel incorrectly clears the `pi_blocked_on` field of the wrong task during `FUTEX_CMP_REQUEUE_PI` operations, leaving a dangling pointer to a freed stack-allocated `rt_mutex_waiter` structure. Exploitation requires a precise sequence of three threads and futex variables, creating a dependency cycle that triggers an `-EDEADLK` rollback path. This leads to stale memory references, which attackers can manipulate to write controlled data to kernel memory. The exploit chain employs advanced techniques, including KASLR bypass via prefetch-timing attacks, predictable kernel memory placement using CPU Entry Area (CEA) regions, and hijacking kernel function pointers such as the IPv6 UDP protocol handler to gain arbitrary code execution. A final "DirtyMode" technique modifies sysctl permissions (e.g., `/proc/sys/kernel/core_pattern`) to execute binaries with root privileges. Demonstrated in Google’s kernelCTF, the exploit achieved a 97% reliability rate and earned a $92,000 reward. GhostLock affects all Linux systems running kernels from 2.6.39 to 7.1, with no elevated privileges or namespaces required, making containerized environments particularly vulnerable. While mitigations like `RANDOMIZE_KSTACK_OFFSET` and `STATIC_USERMODE_HELPER` offer partial protection, the only complete fix is applying the kernel patch. The widespread impact on cloud infrastructure, containers, and shared hosting underscores the severity of this long-undetected flaw.

Critical Linux Kernel Vulnerability (CVE-2026-23111) Enables Local Privilege Escalation A use-after-free vulnerability in the Linux kernel’s nftables subsystem has been disclosed, allowing unprivileged local attackers to escalate privileges to root on widely used distributions, including Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Tracked as CVE-2026-23111, the flaw was discovered in early 2025 and patched upstream on February 5, 2026, via a kernel commit. The bug resides in the nft_map_catchall_activate() function within nftables, a packet filtering framework built on Linux’s Netfilter hooks. Testing in a controlled lab environment revealed that Rocky Linux exhibited lower vulnerability exposure post-update compared to Ubuntu and Red Hat systems. However, kernel backports and system configurations influence risk, meaning version numbers alone may not fully indicate exposure. The vulnerability appears to affect Linux kernels 5.15 and later, while default kernels in AlmaLinux and Rocky Linux (5.14) remain unaffected. The flaw underscores the ongoing risks of privilege escalation in Linux environments, particularly in systems relying on nftables for network filtering.

Linux Kernel Vulnerability Exposes Systems to Control-Flow Hijacking via STP Timer Flaw A proof-of-concept (PoC) exploit has been released for a use-after-free vulnerability in the Linux kernel’s software bridge implementation (`net/bridge`), specifically within the Spanning Tree Protocol (STP) timer lifecycle. The flaw, identified by researchers n132 and Sven Sze during the TyphoonPWN 2026 competition, could allow attackers to hijack kernel control flow by referencing freed bridge memory. The vulnerability stems from inconsistent cleanup behavior in the Linux bridge driver. When a bridge interface is administratively down but STP is enabled, certain timers such as `hello_timer`, `tcn_timer`, and port-specific timers may remain active even after the bridge’s underlying `net_device` is freed. This occurs because the `dellink` deletion path fails to invoke `br_stp_disable_bridge()`, leaving dangling timer entries pointing to deallocated memory. An attacker with local access or the ability to manipulate bridge configurations could exploit this flaw by forcing a port into the LEARNING state, triggering timer activation without verifying the bridge’s operational status (IFF_UP flag). When the kernel later executes these timers in softirq context, it risks dereferencing freed memory, potentially enabling control-flow hijacking if the freed object is reclaimed with malicious data. The issue was patched in Linux commit `2a00517db8de4be7df3d483b215c5544fb30a191`, which addresses the cleanup inconsistency. Administrators are advised to apply the fix or update to kernel versions incorporating the patch to mitigate the risk. The disclosure was coordinated by SSD Secure Disclosure following the researchers’ second-place finish in the Linux privilege escalation category at TyphoonPWN 2026.

Critical "Bad Epoll" Linux Kernel Flaw Enables Root Escalation on Servers, Desktops, and Android A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46242 and dubbed "Bad Epoll," allows unprivileged local attackers to escalate privileges to root on Linux servers, desktops, and Android devices. The flaw stems from a use-after-free (UAF) and race condition in the kernel’s epoll subsystem, a core component that cannot be disabled without breaking critical OS functionality. The vulnerability was discovered and exploited by security researcher Jaeyoung Chung, who submitted it as a zero-day to Google’s kernelCTF program, earning a $71,337+ bounty. Unlike most Linux privilege-escalation bugs, Bad Epoll is particularly dangerous because it affects Android and can be chained with Chrome renderer sandbox escapes, enabling full kernel code execution. The exploit targets a race condition in `ep_remove()`, where a concurrent `__fput()` call can observe a transient NULL value, bypassing cleanup and freeing a `struct eventpoll` still in use. This corrupts kernel memory, and due to SLAB_TYPESAFE_BY_RCU, the freed memory slot may be recycled, allowing attackers to trigger a kmem_cache_free() on the wrong slab cache. Chung’s exploit achieves ~99% reliability by widening the narrow race window (just six instructions) and retrying without crashing the system. The attack leverages four epoll objects two to trigger the race and two as victim objects converting an 8-byte UAF write into a full file object UAF via a cross-cache attack. From there, attackers gain arbitrary kernel memory read access via `/proc/self/fdinfo` and execute a return-oriented programming (ROP) chain to spawn a root shell. The flaw was introduced by a 2023 kernel commit that added two separate race conditions in the same 2,500-line epoll code path. While the first (CVE-2026-43074) was detected by Anthropic’s AI model Mythos, Bad Epoll evaded automated discovery due to its narrow timing window and minimal runtime evidence, rarely triggering KASAN (the kernel’s memory-error detector). Initial patch attempts were incomplete, and a correct fix took nearly two months to land. With no workaround available, administrators must apply the upstream patch or await distribution backports to mitigate the risk. The vulnerability underscores the growing complexity of kernel race conditions and the challenges in detecting them, even with advanced AI-assisted tools.