Linux vhost bug CVE-2026-74580 gives local root and a VM escape
CVE-2026-74580, a stale-cache flaw in the Linux kernel's vhost subsystem, gives local users root and — with a virtual IOMMU — lets a guest write into the host. Patched.
Stories tagged: #linux
AnyDesk Linux pre-auth root RCE gets public exploit, no CVE
V12 published a working pre-auth exploit giving root on AnyDesk Linux 8.0.2 over TCP/7070. AnyDesk fixed it silently in 8.0.3 in June with no CVE and a 'crash' changelog note.
Spectre-v2 BTR attack leaks Linux root hash on patched Intel CPUs
VUSec's Branch Target Reuse attack revives Spectre-v2 through JIT engines, leaking a Linux root password hash in minutes on fully patched Intel systems. Kernel fixes are merged.
GhostLock (CVE-2026-43499): 15-year rtmutex UAF gives root on every Linux distro
A use-after-free in the Linux kernel's futex priority-inheritance path, present since May 2011, hands root to any local user. Fixed in mainline commit 3bfdc63936dd; distros started shipping July 9.
Januscape (CVE-2026-53359): 16-year-old KVM UAF escapes VMs on Intel and AMD
A shadow-MMU use-after-free in KVM/x86 lets a root guest reach into the host on Intel VMX and AMD SVM. Stable kernels shipped the fix on July 4; embargo lifted July 6 with a public PoC.
Bad Epoll CVE-2026-46242: Linux epoll race lifts any user to root
A race-condition use-after-free in the Linux kernel epoll subsystem lets an unprivileged process reach root on desktops, servers, and Android. Reported to Google kernelCTF by Jaeyoung Chung.
Linux pedit COW CVE-2026-46331: page-cache LPE PoC drops in 24h
Researcher Massimiliano Oldani published a working root exploit (packet_edit_meme) for CVE-2026-46331 one day after the kernel.org CVE landed. Ubuntu 18.04–26.04 vulnerable.
Linux DirtyClone CVE-2026-43503: working LPE PoC from JFrog
JFrog published a full local-root exploit for the DirtyFrag-family kernel flaw CVE-2026-43503 on June 25. Patched in v7.1-rc5. Container hosts are the priority.
Linux nf_tables CVE-2026-23111: full LPE chain now public via Exodus
Exodus Intelligence published a complete local root exploit for CVE-2026-23111 — a one-character nf_tables UAF patched upstream Feb 5. Container escape on default distros.
CIFSwitch: 19-year-old Linux CIFS bug gives any local user root
Researcher Asim Manizada disclosed CIFSwitch on May 28 — a cifs.spnego upcall flaw that grants root on default Mint, Rocky, AlmaLinux, Kali, and SUSE 15 SP7.