# Linux kernel privilege escalation vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/linux-kernel-privilege-escalation-vulnerabilities
> Updated: 2026-09-19T12:56:04.000Z. Sources: 4. Developments: 3.

Multiple vulnerabilities have been identified in the Linux kernel that allow for local privilege escalation. These include ‘Copy Fail’ (CVE-2026-31431) and ‘DirtyFrag’, which involve page cache corruption bugs that can allow attackers to manipulate system files or the in-memory view of setuid binaries. ‘Copy Fail’ has been reported as exploited in the wild. Additionally, the ‘ZcopyReaper’ flaw (CVE-2026-43502) affects the Reliable Datagram Sockets subsystem due to a cleanup error in the zero-copy send path.

Recent developments show increased active exploitation and the release of public proof-of-concept exploits. CISA has added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog, noting that these are being used against systems that have not been updated or rebooted since patches were released in 2025.

Furthermore, security researcher Asim Viladi Oglu Manizada has released public exploits for four local root vulnerabilities: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). Some of these flaws reportedly existed in the code for up to 21 years. While some require unprivileged user namespaces, DiagSpill can be exploited without specific preconditions. Experts indicate that while remote root takeover remains theoretical, remote exploitation is currently limited to causing system crashes.

In the context of these risks, the role of Linux security mechanisms, such as process capabilities and file permissions, is highlighted. While process capabilities allow for granular control to prevent the need for full superuser status, security risks persist if writable objects can be used to modify components consumed by privileged processes.

## Timeline

### 2026-09-19: Linux kernel vulnerabilities face active exploitation and public exploits

Linux kernel vulnerabilities are facing increased risk as CISA identifies three actively exploited flaws and a researcher releases public exploits for four local root privilege escalation bugs.

2 sources. https://clstr.news/cluster/linux-kernel-vulnerabilities-face-active-exploitation-and-public-exploits

### 2026-09-15: Linux security mechanisms and privilege escalation risks

Linux security relies on granular process capabilities and strict file permission management to prevent privilege escalation and protect trust boundaries between users and privileged processes.

2 sources. https://clstr.news/cluster/linux-security-mechanisms-and-privilege-escalation-risks

### 2026-09-10: Linux kernel vulnerabilities allow local privilege escalation

New Linux kernel vulnerabilities, including the exploited ‘Copy Fail’ and the ‘ZcopyReaper’ RDS bug, allow local users to escalate privileges to root access.

2 sources. https://clstr.news/cluster/linux-kernel-vulnerabilities-allow-local-privilege-escalation

---
Cite as: Linux kernel privilege escalation vulnerabilities. CLSTR, https://clstr.news/situations/linux-kernel-privilege-escalation-vulnerabilities