Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.
A researcher disclosed OVSwrap, a Linux kernel flaw in the Open vSwitch datapath that lets an ordinary local user gain root, and published a working exploit covering roughly 800 builds. Tracked as CVE-2026-64531, it is an integer wraparound in how Open vSwitch handles internally generated network action streams, giving a deterministic memory-corruption path. The attacker needs no existing switch, no running daemon, and no special privileges: where unprivileged user namespaces are enabled, they create a private namespace, gain network capabilities inside it, and reach the vulnerable code. The module can even auto-load on demand, so an empty module list does not mean safety. Default configurations of most major distributions tested as exploitable.
Qualys disclosed RefluXFS, a race condition in the Linux kernel's XFS copy-on-write path that lets an ordinary local user overwrite protected files and take root. Tracked as CVE-2026-64600, it triggers when two concurrent direct writes target the same reflinked file: the kernel briefly drops its inode lock, and a second writer can make the first write land on a stale block. The overwrite happens at the block layer, so ownership, permissions, timestamps, and the setuid bit stay untouched and no kernel log entry appears. Qualys reports it works with SELinux enforcing and estimates over 16 million affected systems.
Researchers at Nebula Security disclosed GhostLock, a Linux kernel flaw that lets any logged-in user gain full root on an unpatched machine, and it also escapes containers. Tracked as CVE-2026-43499, the bug has shipped by default in essentially every mainstream distribution since 2011 and needs no special permissions or network access; ordinary threading calls from any local program are enough. Nebula built a working exploit it says is 97 percent reliable and published the code, though no in-the-wild use is known yet. There is no full workaround, patch availability is uneven across distributions, and one earlier fix introduced a separate crash bug, so confirm the fixed package version.
A newly disclosed Linux kernel vulnerability called Bad Epoll lets an ordinary user with no special privileges take full control of a machine as root, and it affects Linux desktops, servers, and Android. Tracked as CVE-2026-46242, the flaw is a use-after-free in epoll, a core Linux feature for watching many files or connections at once that programs and browsers rely on and cannot simply turn off. Two parts of the kernel try to free the same object at once, letting an attacker corrupt kernel memory and climb to root. It is a race-condition bug, harder to exploit than recent deterministic Linux flaws, but a working exploit exists and a fix is available.
Researcher Hyunwoo Kim disclosed Dirty Frag yesterday after an unrelated third party broke the embargo five days early. The flaw chains two Linux kernel page-cache write bugs (xfrm-ESP and RxRPC) to give any local user root access on every major distribution - Ubuntu, RHEL, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, Fedora. Like Dirty Pipe and last week's Copy Fail, it's a deterministic logic bug with no race condition required and no kernel panic on failure. PoC is public on GitHub. The ESP variant patch was merged into the netdev tree on May 7 but distribution kernels remain unpatched. No CVE assigned yet because the embargo broke early.
TrustStrike Labs