Linux Kernel Exposes Multiple Local Privilege Escalation Flaws, Prompting Urgent Patching

A series of newly disclosed Linux kernel vulnerabilities has put major operating systems at risk of local privilege escalation. The first flaw, reported in the Fragnesia kernel, allows an attacker to gain root access through page‑cache corruption, a technique that bypasses standard file‑system checks. Shortly thereafter, researchers uncovered CVE‑2026‑46333, an improper privilege‑management bug that has lingered for nine years. The flaw, with a CVSS score of 5.5, permits an unprivileged local user to read sensitive files and execute arbitrary commands as root on default installations of several major distributions.

In parallel, the DirtyDecrypt vulnerability (CVE‑2026‑31635) was patched on April 25 but a proof‑of‑concept exploit remains functional on Fedora, Arch, and openSUSE Tumbleweed. The flaw exploits a missing copy‑on‑write guard in the rxgk module’s decrypt routine, enabling a page‑cache write that escalates privileges on systems with the CONFIG_RXGK option enabled. The third vulnerability, copy.fail (CVE‑2026‑31431), was disclosed on April 29 by Theori. It abuses the kernel crypto API (AF_ALG sockets) combined with splice() to write four bytes directly into a page cache of a file the attacker does not own, without altering the file on disk. The exploit works across Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and Fedora, and is not blocked by Kubernetes Pod Security Standards (Restricted) or the default RuntimeDefault seccomp profile, requiring a custom seccomp policy.

The impact of these flaws is significant. They allow attackers to gain root privileges on systems that permit unprivileged code execution, including containers, CI/CD pipelines, and shared hosting environments. Integrity‑monitoring tools such as AIDE or Tripwire fail to detect the changes because the file on disk remains untouched. In response, the CISA has added copy.fail to its list of actively exploited vulnerabilities and ordered federal agencies to patch within two weeks. System administrators are urged to apply the latest kernel updates immediately and, where possible, enable the dirtyfrag mitigation or custom seccomp profiles to reduce the attack surface.

These incidents underscore the ongoing risk of kernel‑level privilege escalation bugs and the critical importance of timely kernel updates, rigorous patch management, and enhanced container security practices. Vigilance and rapid response remain the best defenses against such hidden threats.