Arch Linux users urged to patch PinTheft kernel flaw

The V12 security team disclosed a Linux kernel local privilege escalation vulnerability named PinTheft, affecting the RDS (Reliable Datagram Sockets) subsystem. A public proof‑of‑concept exploit can turn the RDS zero‑copy double‑free into a page‑cache overwrite, allowing a local attacker to obtain a root shell. The exploit requires the RDS kernel module to be loaded, io_uring enabled, a readable SUID‑root binary, and x86_64 architecture. Arch Linux ships the RDS module enabled by default, making its users the primary at risk, while most other major distributions do not load the module.

A kernel patch was released earlier this month and users should update to the latest kernel package immediately. For systems that cannot be patched right away, V12 provided a mitigation that unloads the RDS modules and prevents them from loading again (e.g., using `rmmod rds_tcp rds` and adding a modprobe blacklist). The vulnerability joins a recent series of Linux LPE bugs such as Dirty Frag, Fragnesia, Copy Fail, and DirtyDecrypt that have seen public exploits and active exploitation in the wild.