{"id":250991,"date":"2026-05-20T13:27:00","date_gmt":"2026-05-20T17:27:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/20\/pintheft-linux-vulnerability-let-attackers-gain-root-access\/"},"modified":"2026-05-21T01:30:08","modified_gmt":"2026-05-21T05:30:08","slug":"pintheft-linux-vulnerability-let-attackers-gain-root-access","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/20\/pintheft-linux-vulnerability-let-attackers-gain-root-access\/","title":{"rendered":"PinTheft Linux Vulnerability Let Attackers Gain Root Access"},"content":{"rendered":"

PinTheft Linux Vulnerability Let Attackers Gain Root Access<\/a><\/p>\n

https:\/\/cybersecuritynews.com\/pintheft-linux-vulnerability\/<\/a><\/p>\n

Publish Date: 2026-05-20 13:27:00<\/a><\/p>\n

Source Domain: cybersecuritynews.com<\/a><\/p>\n

A proof-of-concept (PoC) exploit was published for a new Linux Local Privilege Escalation (LPE) vulnerability dubbed \u201cPinTheft.\u201d<\/p>\n

Discovered by Aaron Esau of the V12 security team, the flaw allows local attackers to gain root access by exploiting an RDS zerocopy double-free bug.<\/p>\n

A kernel patch is currently available, prompting the researchers to release their PoC code to the public.<\/p>\n

PinTheft joins a growing list of recently disclosed Linux kernel vulnerabilities, underscoring the ongoing security challenges within complex kernel networking and asynchronous I\/O subsystems.<\/p>\n

The vulnerability resides within the Reliable Datagram Sockets (RDS) zerocopy send path. Specifically, the function rds_message_zcopy_from_user() pins user pages one at a time during execution.<\/p>\n

If a subsequent page faults, the error path drops the pages it already pinned. A critical flaw emerges during later RDS message cleanup, which drops these pages a second time because the scatterlist entries and entry count remain active after the zcopy notifier clears.<\/p>\n

This double-free condition allows each failed zerocopy send to steal exactly one reference from the first page.<\/p>\n

To weaponize this reference count bug, the PinTheft exploit leverages io_uring. The attacker registers an anonymous page as a fixed buffer, assigning the page a FOLL_PIN bias of 1024 references.<\/p>\n

The exploit then systematically steals these references through failing RDS zerocopy sends until io_uring is left holding a stolen page pointer. This unique methodology of stealing FOLL_PIN references is what gives the exploit its name.<\/p>\n

PinTheft Linux Vulnerability Exploit<\/strong><\/h2>\n

The PoC repository provides a highly structured exploitation sequence to achieve root access while attempting to prevent permanent system corruption. The attack execution follows a precise chain of events:<\/p>\n