{"id":445709,"date":"2026-05-12T22:53:11","date_gmt":"2026-05-12T22:53:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/445709\/"},"modified":"2026-05-12T22:53:11","modified_gmt":"2026-05-12T22:53:11","slug":"linux-defenders-face-patch-and-exploit-race","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/445709\/","title":{"rendered":"Linux Defenders Face Patch and Exploit Race"},"content":{"rendered":"

\n Security Operations<\/a>\n <\/p>\n

Kernel Privilege Escalation Has One Linux Maintainer Contemplating a ‘Kill Switch’<\/p>\n

Tiffany Wang<\/a> \u2022
\n May 12, 2026 \u00a0 \u00a0 <\/p>\n

\"Linux
\n Image: Shutterstock <\/p>\n

Back-to-back kernel vulnerabilities in Linux has defenders scrambling to apply defenses in the age of quick turnaround time for hackers to exploit nascent flaws.<\/p>\n

See Also: How Organizations Are Strengthening Defenses Against Scattered Spider<\/a><\/p>\n

“Dirty Frag” and “Copy Fail” kernel privilege escalation vulnerabilities became public knowledge within two weeks of each other (see: ‘Dirty Frag’ Gives Root on Linux Distros<\/a>).<\/p>\n

Microsoft said<\/a> in a Friday blog that it has found limited in-the-wild activity associated with either one of the vulnerabilities. <\/p>\n

One Linux maintainer is floating the possibility of integrating a “kill switch” feature that would allow admins to temporarily shut down vulnerable kernel functions while patches are developed. <\/p>\n

“For most users, the cost of ‘this socket family stops working for the day’ is much smaller than the cost of running a known vulnerable kernel until the fix land,” Linux stable kernel co-maintainer and Nvidia engineer Sasha Levin wrote in an email<\/a>.<\/p>\n

The proposal is not official and it’s only meant to buy time between kernel vulnerability discoveries and patch releases.<\/p>\n

“As we’ve seen with the discovery of ‘Dirty Frag’ fresh on the heels of ‘Copy Fail,’ AI-assisted vulnerability discovery is rapidly accelerating the identification of new vulnerabilities, a trend that is only going to continue as these models continue to become more powerful,” said Scott Caveza, senior staff research engineer at Tenable.<\/p>\n

Defenders in production environments are wary about collateral damages of emergency kernel patching.<\/p>\n

“Applying kernel updates and rebooting across enterprise systems requires planning, downtime and risk assessments, leaving system administrators on edge for the ‘what if’ scenarios: what happens if this patch causes unrelated performance issues?” Caveza said.<\/p>\n

“Dirty Frag” affects Linux distributions including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, openSUSE Tumbleweed and Fedora. It chains two vulnerabilities together: one impacts modules that provide support for storage for EFI boot loaders and is tracked as CVE-2026-43284<\/a>.<\/p>\n

The other affects the RxRPC networking subsystem and was assigned CVE-2026-43500<\/a> on Monday.<\/p>\n

“A low-privileged local attacker can abuse zero-copy\/splice mechanisms to corrupt privileged files such as \/usr\/bin\/su or \/etc\/passwd and obtain root privileges, making the issue part of the same broader bug class as Dirty Pipe and Copy Fail,” said<\/a> RedHat.<\/p>\n","protected":false},"excerpt":{"rendered":"Security Operations Kernel Privilege Escalation Has One Linux Maintainer Contemplating a ‘Kill Switch’ Tiffany Wang \u2022 May 12,…\n","protected":false},"author":2,"featured_media":445710,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[14349,11571,14332,14335,14334,14333,14342,14343,14344,14345,14347,61,14336,14339,14341,14340,14338,14337,60,14348,12802,14346,80],"class_list":["post-445709","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-anti-money-laundering","tag-authentication","tag-bank-information-security","tag-bank-information-security-regulations","tag-bank-regulations","tag-banking-information-security","tag-fdic","tag-fincen","tag-gao","tag-glba","tag-identity-theft","tag-ie","tag-information-security","tag-information-security-articles","tag-information-security-events","tag-information-security-news","tag-information-security-webinars","tag-information-security-white-papers","tag-ireland","tag-phishing","tag-risk-management","tag-sarbanes-oxley-sox","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/445709","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=445709"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/445709\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/445710"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=445709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=445709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=445709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}