Stories tagged: #lpe

> Jul 12, 2026#cve #linux

GhostLock (CVE-2026-43499): 15-year rtmutex UAF gives root on every Linux distro

A use-after-free in the Linux kernel's futex priority-inheritance path, present since May 2011, hands root to any local user. Fixed in mainline commit 3bfdc63936dd; distros started shipping July 9.

> Jul 09, 2026#cve #microsoft

Microsoft patches Defender RoguePlanet LPE CVE-2026-50656

Microsoft shipped Malware Protection Engine 1.1.26060.3008 on July 9 to close a race condition in mpengine.dll that hands SYSTEM to any local user. Public PoC has been circulating for a month.

> Jun 01, 2026#vulnerability #linux

CIFSwitch: 19-year-old Linux CIFS bug gives any local user root

Researcher Asim Manizada disclosed CIFSwitch on May 28 — a cifs.spnego upcall flaw that grants root on default Mint, Rocky, AlmaLinux, Kali, and SUSE 15 SP7.