[REVISION HISTORY]
Linux kernel privilege escalation and KVM escape flaws
5 recorded revisions of this situation.
What changed
2026-10-04 09:17 UTC → 2026-10-20 09:27 UTC ·
added
removed
Multiple vulnerabilities have been identified in the Linux kernel that allow for continue to pose significant security risks, ranging from local privilege escalation. These escalation to virtual machine escapes. Local privilege escalation risks include ‘Copy Fail’ (CVE-2026-31431) and ‘DirtyFrag’, which involve page cache corruption bugs that can allow attackers to manipulate system files or the in-memory view of setuid binaries. ‘Copy Fail’ has been reported as exploited in ‘DirtyFrag’ specifically extends these risks to the wild. networking stack. Additionally, the ‘ZcopyReaper’ flaw (CVE-2026-43502) affects the Reliable Datagram Sockets subsystem due to a cleanup error in the zero-copy send path. Recent developments show increased active exploitation and the release of public proof-of-concept exploits. CISA path; researchers noted this issue has added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog, noting that these are being used against systems that have not been updated or rebooted existed since patches were released in 2025. Furthermore, security researcher Asim Viladi Oglu Manizada Linux version 4.17. A new critical vulnerability, dubbed ‘PwnEscape’ (CVE-2026-99999), has released public exploits for four local root vulnerabilities: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). Some been disclosed with a CVSS score of these flaws reportedly existed in 9.3. Discovered by researcher Paulos Yibelo using the code for up to 21 years. While some require unprivileged user namespaces, DiagSpill can be exploited without specific preconditions. Experts indicate that while remote root takeover remains theoretical, remote exploitation is currently limited to causing system crashes. Newer security advisories have addressed AI model GPT-5.6 Sol, the DirtyAH6, TUNderflow, PPPoEject, and DiagSpill flaws following flaw resides in the release IPv4 network stack’s handling of public exploit code. Additionally, checksum metadata. By sending packets with incorrect checksum information, a flaw malicious guest in the eBPF verifier (CVE-2026-93127) has been identified; this error could allow a program virtual machine can exploit a delay in checksum calculation to access cause memory outside of approved boundaries due corruption, allowing them to an incorrect understanding of processed values. read host memory or execute arbitrary code on the host OS. While no confirmed exploitation of the eBPF flaw has been reported, administrators are advised to install kernel updates and review user permissions for loading eBPF programs. Newer research has detailed CVE-2025-39964, is not a long-standing vulnerability in the AF_ALG userspace cryptographic interface. New critical vulnerabilities defect in KVM (Kernel-based Virtual Machine) have been identified itself, it poses a major risk to virtualization and cloud environments. In response, Sakura Internet has suspended certain VPS applications to implement countermeasures, though AWS has stated its managed services are unaffected. While patches are available for Debian, Ubuntu, and RHEL, experts note that enable guest-to-host escapes. current fixes are primarily defense-in-depth measures, with more comprehensive input validation still under development.
Versions
- 2026-10-20 09:27 UTC Linux kernel privilege escalation and KVM escape flaws
- 2026-10-04 09:17 UTC Linux kernel privilege escalation and KVM escape flaws
- 2026-09-26 00:05 UTC Linux kernel privilege escalation vulnerabilities
- 2026-09-21 02:29 UTC Linux kernel privilege escalation vulnerabilities
- 2026-09-20 09:53 UTC Linux kernel privilege escalation vulnerabilities
- 2026-09-17 04:49 UTC Linux kernel privilege escalation vulnerabilities
Select a version to see what changed compared to the one before it.