Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Linux kernel RDS PinTheft local privilege escalation flaw (public PoC)

Vulnerability
First reported
Last updated
Happening score
H score 15
1 unique sources, 1 articles

Summary

Hide ▲

PinTheft now has a public PoC exploit, turning a recently patched Linux kernel RDS flaw into a practical local privilege escalation risk for Arch Linux systems. V12 says the bug can let local attackers reach root privileges by abusing an RDS zerocopy double-free. The exploit works only under specific conditions, including loaded RDS support and enabled io_uring, but it still materially raises exposure on systems that meet those prerequisites. Administrators should install the latest kernel updates or temporarily block the module to reduce abuse.

Related Happenings

Windows User Profile Service arbitrary hive load elevation of privileges privilege-escalation flaw

Vulnerability
H score11 First: 15.07.2026 14:07 Last: 15.07.2026 14:07 Sources 1

About this happening: A new LegacyHive proof-of-concept exposes a Windows User Profile Service (ProfSvc) arbitrary hive-load elevation-of-privileges flaw on supported Windows desktop and...

Open Happening

Linux kernel CIFS subsystem CIFSwitch local privilege escalation privilege-escalation flaw

Vulnerability
H score31 First: 30.05.2026 17:16 Last: 30.05.2026 17:16 Sources 1

About this happening: The Linux kernel CIFS subsystem has a disclosed CIFSwitch local privilege-escalation flaw that can let an unprivileged local attacker reach root privileges by abus...

Latest development: 01.06.2026 14:19

Major Linux distributions rolled out fixes for the CIFSwitch Linux kernel CIFS privilege-escalation flaw, and Manizada published PoC code to help defenders validate patches, mitigations, detections, and exposure. Linux Mint, CentOS, Rocky Linux, Kali Linux, AlmaLinux, and SLES SAP systems that ship cifs-utils by default are vulnerable, and some distros are vulnerable only if cifs-utils was manually installed.

Open Happening

Linux kernel improper privilege management flaw (CVE-2026-46333)

Vulnerability
H score39 First: 21.05.2026 10:35 Last: 21.05.2026 10:35 Sources 1

About this happening: A Linux kernel privilege-management flaw, CVE-2026-46333, can let unprivileged local users on Debian, Fedora, and Ubuntu disclose /etc/shadow and SSH host ke...

Open Happening

Linux kernel rxgk local DirtyDecrypt/DirtyCBC privilege-escalation flaw (CVE-2026-31635)

Vulnerability
H score41 First: 18.05.2026 10:18 Last: 18.05.2026 10:18 Sources 1

About this happening: A proof-of-concept exploit has been released for DirtyDecrypt/DirtyCBC (CVE-2026-31635), a recently patched Linux kernel flaw in rxgk_decrypt_skb() that can en...

Open Happening

Windows cldflt.sys privilege escalation (CVE-2020-17103)

Vulnerability
H score28 First: 18.05.2026 01:30 Last: 18.05.2026 01:30 Sources 1

About this happening: A public MiniPlasma proof-of-concept has renewed concern around the Windows cldflt.sys Cloud Filter driver because it can elevate a standard user to SYSTEM on fu...

Open Happening

Timeline

  1. 20.05.2026 13:52 2 articles · 1mo ago

    Public PoC released for PinTheft on Arch Linux

    Initial Disclosure

    V12 disclosed a public PoC exploit for PinTheft, a Linux local privilege escalation flaw in the RDS kernel module that can let local attackers obtain root privileges on Arch Linux systems. The exploit depends on the RDS module being loaded, io_uring being enabled, a readable SUID-root binary, and x86_64 support, and administrators are advised to install the latest kernel updates or temporarily block rds and rds_tcp to reduce exposure.

    Show sources
    Open in new tab