Privilege-Escalation

Overview Attribute Value CVE CVE-2026-64564 Name SCTPhantom Type Use-After-Free (UAF) → Local Privilege Escalation + Container Escape CVSS 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Linux kernel 2.6.25 → 7.1.x (introduced 2007, ~18 years) Fixed 6.6.148, 6.12.101, 6.18.42, 7.1.6, mainline 7.2-rc5 Researcher Tencent Zhuque Lab (via Corvus AI pipeline) PoC ✅ Public (reproducible exploit demonstrated) CISA KEV ❌ Not yet listed Patch ✅ Upstream (mainline commit 9b2854f86f0b) What Is SCTPhantom? SCTPhantom is a use-after-free in the Linux kernel’s SCTP (Stream Control Transmission Protocol) Dynamic Address Reconfiguration implementation. An attacker who can reach the SCTP stack can trigger a stale-pointer dereference that leads to full root on the host — and, critically, escape a container to compromise the underlying host. ...

GhostLock: The 15-Year-Old Linux Kernel Bug AI Found Hiding in Plain Sight TL;DR An AI-powered security agent discovered a Linux kernel vulnerability that has existed in every major distribution since 2011. It allows any unprivileged local user to gain full root access with a 97% success rate. There is no practical mitigation — patch your kernel. Attribute Detail CVE CVE-2026-43499 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-416 (Use After Free) Affected Linux 2.6.39 through 7.0 Fixed Linux 7.1 (commit 3bfdc63936dd) Stable backports 6.1.177, 6.6.144, 6.12.95, 6.18.36, 7.0.13 Not backported 5.15.y, 5.10.y LTS Discovered by VEGA AI Agent (Nebula Security) Bounty $92,337 (Google kernelCTF) Prerequisites Local access, no special privileges, CONFIG_FUTEX_PI=y What Is GhostLock? GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s real-time mutex (rtmutex) priority-inheritance code. Specifically, it lives in the remove_waiter() function in kernel/locking/rtmutex.c. ...

CVE-2022-0492: Linux Kernel Cgroups v1 release_agent Container Escape Executive Summary CVE-2022-0492 is a privilege escalation vulnerability in the Linux kernel’s cgroup_release_agent_write function (kernel/cgroup/cgroup-v1.c). It allows a root process inside a container to escape to the host and gain full root privileges by abusing the cgroups v1 release_agent mechanism via user namespaces. Attribute Detail CVE CVE-2022-0492 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-862 (Missing Authorization) / CWE-287 (Improper Authentication) Affected Linux kernel v2.6.24 through v5.16.6 Fixed Linux 5.17-rc3 (commit 24f6008564183) Type Container escape via cgroups v1 release_agent CISA KEV ✅ Added June 2, 2026 — actively exploited Public PoC ✅ Multiple (GitHub) Background: What is release_agent? cgroups v1 has a feature called release_agent — a path to a binary the kernel executes as root when a process in a child cgroup terminates (if notify_on_release is enabled). It lives in any cgroup v1 root directory: ...

Overview Attribute CVE-2026-41091 CVE-2026-45498 Type Local Privilege Escalation Denial of Service Component Malware Protection Engine Antimalware Platform Affected Engine ≤ 1.1.26030.3008 Platform ≤ 4.18.26030.3011 CWE CWE-59 (Link Following) — Impact Standard user → SYSTEM Defender disabled / system unresponsive Exploit ✅ Active in the wild ✅ Active in the wild Patch Engine 1.1.26040.8 Platform 4.18.26040.7 CISA KEV ✅ Added 2026-05-20 ✅ Added 2026-05-20 FCEB Deadline June 3, 2026 June 3, 2026 Microsoft has started rolling out patches for two actively exploited zero-day vulnerabilities in Microsoft Defender. Both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 20, with federal agencies ordered to patch within two weeks. ...

TL;DR MiniPlasma is a Windows local privilege escalation exploit that achieves standard user → SYSTEM on fully patched Windows 11 systems (including the May 2026 Patch Tuesday updates). The jaw-dropper? It targets the exact same vulnerability that Google Project Zero reported in September 2020 and Microsoft claimed to fix in December 2020. CVE: CVE-2020-17103 (CVSS 7.0) — supposedly patched Component: cldflt.sys — Windows Cloud Files Minifilter driver Flaw: TOCTOU race condition in HsmOsBlockPlaceholderAccess Impact: Full SYSTEM shell from standard user Affected: All Windows versions (confirmed on Win11 with May 2026 updates) Not affected: Latest Windows 11 Insider Preview Canary builds (suggests a fix may be incoming) Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/MiniPlasma The Ghost Patch Problem In cybersecurity, few things are more unsettling than a patch that never actually landed. That’s exactly what happened here. ...

TL;DR GreenPlasma (SB2026051378) is an unpatched Windows privilege escalation that chains a ctfmon.exe section creation bug with registry symlink hijacking and DACL relaxation to go from standard user → SYSTEM with zero interaction. No CVE assigned yet. No patch available. Affected: Windows 11, Windows Server 2022/2026 Not affected: Windows 10 (different ctfmon implementation) Requires: Standard user, interactive session Impact: Full SYSTEM shell Researcher: Chaotic Eclipse / Nightmare-Eclipse Public PoC: github.com/Nightmare-Eclipse/GreenPlasma The Context: Chaotic Eclipse’s Disclosure Campaign This is the fifth zero-day from the researcher Chaotic Eclipse (aka Nightmare-Eclipse), who has been publicly releasing Windows vulnerabilities after disputes with Microsoft’s MSRC over bug bounty responses. ...

Overview Attribute Value CVE (ESP variant) CVE-2026-43284 CVE (RxRPC variant) CVE-2026-43500 (reserved, no patch yet) Name Dirty Frag Type Local Privilege Escalation (LPE) Affected Ubuntu 24.04, RHEL 10.1, CentOS Stream 10, AlmaLinux 10, Fedora 44, openSUSE Tumbleweed — effectively all major distros Effective Lifetime ~9 years (xfrm-ESP since 2017, RxRPC since 2023) Race Condition None — deterministic Researcher Hyunwoo Kim (@v4bel) PoC ✅ Public (github.com/V4bel/dirtyfrag) ESP Patch ✅ Merged to mainline (f4c50a4034e6) RxRPC Patch ❌ No patch in any tree yet What Is Dirty Frag? Dirty Frag is a vulnerability class — not a single bug — that extends the same lineage as Dirty Pipe (CVE-2022-0847) and Copy Fail (CVE-2026-31431). Where Dirty Pipe overwrites struct pipe_buffer and Copy Fail overwrites the AF_ALG scatterlist, Dirty Frag overwrites the frag member of struct sk_buff. ...

Overview Attribute Value CVE ID CVE-2026-31431 Name Copy Fail CVSS Score ~8.4 (High) Type Local Privilege Escalation (LPE) Affected All major Linux distributions since 2017 Tested Ubuntu 24.04, Amazon Linux 2023, RHEL 14.3, SUSE 16 Kernels 6.12, 6.17, 6.18 (and all back to 2017) Exploit Size 732 bytes (Python script) Dependencies Python 3.10+ (for os.splice), standard library only Race Condition None — deterministic, straight-line exploit Stealth Page cache corrupted; on-disk file and checksums unchanged What Makes Copy Fail Different Linux kernel privilege escalation bugs are not new. But Copy Fail stands apart from its predecessors in four critical ways: ...

Overview Same researcher, same target, new weapon. Nightmare-Eclipse — the security researcher behind the BlueHammer Windows Defender LPE zero-day — has released UnDefend, a tool that can completely disable Windows Defender from a standard user account with no administrative privileges. Where BlueHammer escalates privileges through Defender, UnDefend simply kills Defender’s ability to protect you — and does it without needing admin rights at all. Attribute Value Tool UnDefend Author Nightmare-Eclipse (Chaotic Eclipse) Repository github.com/Nightmare-Eclipse/UnDefend Language C++ License MIT Stars 32 (as of Apr 13, 2026) Requires Admin ❌ No CVE Pending / Not assigned Patch ❌ None Related BlueHammer (LPE zero-day, same researcher) How It Works UnDefend operates in two modes: ...

Overview Attribute Value CVE ID CVE-2026-33825 CVSS Score 7.8 Vendor Microsoft Product Windows Defender Antivirus (Windows 10/11, Server 2016+) Vulnerability Type TOCTOU + Path Confusion → Local Privilege Escalation Status ✅ Patched (April 14, 2026 Patch Tuesday) CWE CWE-367 (Time-of-check Time-of-use Race Condition) KEV Added Not yet Exploitation Status ⚠️ PoC public, no confirmed in-the-wild attacks yet Patch Status ❌ Unpatched (as of April 12, 2026) Affected Versions Version Status Windows 10 (1709+) ❌ Vulnerable Windows 11 ❌ Vulnerable Windows Server 2016+ ⚠️ Partial (elevated admin, not full SYSTEM) Windows 10 (pre-1709) ✅ Not affected (no Cloud Files API) Description BlueHammer is a local privilege escalation vulnerability in Microsoft Defender Antivirus that chains a TOCTOU race condition with path confusion in Defender’s signature update workflow. A standard user can exploit Defender’s own privileged update mechanism to leak the SAM hive, decrypt credentials, and achieve SYSTEM privileges. ...