Multiple Linux kernel exploits released after patching: PinTheft, DirtyDecrypt, and others

A series of proof‑of‑concept exploits for Linux kernel vulnerabilities have been published after the affected bugs were patched, raising concerns about the persistence of local privilege escalation risks. The most recent PoC targets the PinTheft flaw, a zero‑copy double‑free in the RDS (Reliable Datagram Sockets) module that turns into a page‑cache overwrite via io_uring fixed buffers. The exploit requires the RDS module to be loaded, io_uring enabled, a readable SUID‑root binary, and an x86_64 architecture, conditions that are met by default on Arch Linux. Once the vulnerability is triggered, the PoC steals FOLL_PIN references until io_uring holds a stolen page pointer, allowing an attacker to spawn a root shell. V12 recommends that users install the latest kernel updates immediately and, if patching is delayed, unload the rds_tcp and rds modules and add modprobe rules to block them.

The same advisory also highlights other recent local‑privilege‑escalation bugs, including DirtyDecrypt (also known as DirtyCBC), Copy Fail, and Pack2TheRoot. A PoC for DirtyDecrypt was released after the kernel patch was applied. The vulnerability, discovered and reported by the Zellic and V12 security team on 9 May 2026, exploits a block‑cipher mode that insecurely uses encryption keys. Although the patch already addressed the issue, the PoC demonstrates that the duplicate vulnerability can still be exploited if the kernel remains unpatched. The release underscores the importance of timely kernel updates.

In addition, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Copy Fail to its list of actively exploited flaws and ordered federal agencies to secure Linux systems within two weeks. The combined advisories emphasize the need for rapid patch deployment and module mitigation to protect Linux environments from local privilege escalation attacks.