Exploit released for new PinTheft Arch Linux root escalation flaw

PinTheft is a newly discovered Linux kernel privilege‑escalation flaw that targets the RDS (Reliable Datagram Sockets) module. The vulnerability is a zerocopy double‑free in rds_message_zcopy_from_user() that can be turned into a page‑cache overwrite through io_uring fixed buffers. A publicly available PoC now exists that steals FOLL_PIN references until io_uring holds a stolen page pointer, allowing a local attacker to spawn a root shell. The flaw requires the RDS module to be loaded, io_uring to be enabled, a readable SUID‑root binary, and x86_64 architecture, which limits the attack surface to Arch Linux where the module is enabled by default.

The kernel patch was released earlier this month, but the PoC demonstrates that unpatched systems remain vulnerable. V12 recommends installing the latest kernel update immediately or, if that is not possible, applying a mitigation that unloads the RDS module and blocks its loading via modprobe. The mitigation commands are: rmmod rds_tcp rds and adding “install rds /bin/false” and “install rds_tcp /bin/false” to /etc/modprobe.d/pintheft.conf. This incident follows a wave of other Linux LPE vulnerabilities such as DirtyDecrypt, DirtyCBC, and Copy Fail, many of which have already been exploited in the wild.