[CLSTR]
< Back to situation

[REVISION HISTORY]

Linux kernel privilege escalation vulnerabilities

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-09-17 04:49 UTC → 2026-09-20 09:53 UTC · added removed

Multiple vulnerabilities have been identified in the Linux kernel that allow for local privilege escalation. These include ‘Copy Fail’ (CVE-2026-31431) and ‘DirtyFrag’, which involve page cache corruption bugs that can allow attackers to manipulate system files or the in-memory view of setuid binaries. ‘Copy Fail’ has been reported as exploited in the wild. Additionally, the ‘ZcopyReaper’ flaw (CVE-2026-43502) affects the Reliable Datagram Sockets subsystem due to a cleanup error in the zero-copy send path. Recent developments show increased active exploitation and the release of public proof-of-concept exploits. CISA has added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog, noting that these are being used against systems that have not been updated or rebooted since patches were released in 2025. Furthermore, security researcher Asim Viladi Oglu Manizada has released public exploits for four local root vulnerabilities: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). Some of these flaws reportedly existed in the code for up to 21 years. While some require unprivileged user namespaces, DiagSpill can be exploited without specific preconditions. Experts indicate that while remote root takeover remains theoretical, remote exploitation is currently limited to causing system crashes. In the context of these risks, the role of Linux security mechanisms, such as process capabilities and file permissions, is highlighted. While process capabilities allow for granular control to prevent the need for full superuser status, security risks persist if writable objects can be used to modify components consumed by privileged processes.

Versions

  1. 2026-09-20 09:53 UTC Linux kernel privilege escalation vulnerabilities
  2. 2026-09-17 04:49 UTC Linux kernel privilege escalation vulnerabilities

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.