Affected Systems

Linux kernel versions 4.14 through 7.0.x. Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and mainline 7.1-rc7. CentOS Stream 9 exploit demonstrated. Requires CONFIG_NET_ACT_GACT, CONFIG_NET_CLS_FLOWER, and unprivileged user namespaces enabled. Debian fixed; Ubuntu and SUSE patches pending as of July 28, 2026.

Exploitation Status

Public exploit code available targeting CentOS Stream 9 with kernel-specific hardcoded offsets. No evidence of in-the-wild exploitation as of July 28, 2026. Not listed in CISA KEV catalog. Exploit requires local access, unprivileged user namespaces, specific kernel build options, and kernel-specific ROP chain adaptation.

Business Impact

Local privilege escalation from unprivileged user to root on vulnerable Linux systems. Attacker must already have local shell access. Exploit reliability reported at 100% (10/10 runs, 9-111 seconds) on tested CentOS Stream 9 configuration, but requires kernel-specific customization for other distributions. Systems without unprivileged user namespaces or missing CONFIG_NET_ACT_GACT/CONFIG_NET_CLS_FLOWER are not affected. Upstream patch available since June 1, 2026; distribution rollout incomplete.

Urgency

🟡 Within a week

Recommended Actions

  • Identify Linux systems running kernel versions 4.14 through 7.0.x and prioritize patching to fixed versions (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1-rc7+) via distribution-provided packages.
  • Check if unprivileged user namespaces are enabled (kernel.unprivileged_userns_clone sysctl on some distributions); consider disabling via sysctl if not operationally required to reduce attack surface.
  • Verify kernel build options CONFIG_NET_ACT_GACT and CONFIG_NET_CLS_FLOWER status; systems without both are not exploitable via the published method.
  • Monitor for unusual namespace creation or traffic-control (tc) subsystem activity in audit logs, particularly from non-administrative users.
  • Review Ubuntu and SUSE security trackers for updated kernel packages if running those distributions, as patches were pending at disclosure time.