PinTheft Linux Vulnerability Enables Root Access, PoC Released

A proof-of-concept (PoC) exploit has been publicly released for a newly disclosed Linux local privilege escalation (LPE) vulnerability dubbed “PinTheft.” 

Discovered by Aaron Esau of the V12 security team, the flaw enables local attackers to gain full root access by chaining an RDS zerocopy double-free bug with io_uring fixed buffers. A kernel patch is now available, which prompted the researchers to publish the PoC.

PinTheft resides in the Linux kernel’s Reliable Datagram Sockets (RDS) zerocopy send path, specifically within the rds_message_zcopy_from_user() function.

PinTheft Linux Vulnerability

During execution, this function pins user pages one at a time. If a subsequent page faults, the error path drops all already-pinned pages, but later RDS message cleanup drops them again because scatterlist entries and entry count remain active.

This double-free condition allows each failed zerocopy send to steal exactly one FOLL_PIN reference from the first pinned page, a subtle, deterministic flaw that requires no race condition to exploit reliably.

To weaponize the reference-count bug, PinTheft leverages io_uring’s fixed-buffer mechanism in a precise, multi-stage sequence:

1. Target selection — Locates a readable SUID-root binary, prioritizing /usr/bin/su, /usr/bin/mount, /usr/bin/passwd, or /usr/bin/pkexec.
2. Safety backup — Copies the on-disk binary to /tmp/.backup_<name>_<pid> before any modifications.
3. Page setup — Maps two pages and marks the second PROT_NONE So the RDS zcopy sends predictable faults after pinning only the first page.
4. Fixed-buffer registration — Registers the first page via IORING_REGISTER_BUFFERS, assigning it a GUP_PIN_COUNTING_BIAS of 1,024 references.
5. Clone-buffer hold — A daemon child holds a cloned buffer open via IORING_REGISTER_CLONE_BUFFERS, preventing premature unpin cleanup.
6. Reference theft — 1,024 failing RDS zerocopy sends double-drop the first page during error cleanup, exhausting all FOLL_PIN references while io_uring retains a dangling struct page *.
7. Page-cache reclaim — The SUID binary’s first cached page is evicted and immediately reclaimed, placing live page-cache data at the stale io_uring pointer address.
8. Payload injection — IORING_OP_READ_FIXED overwrites the SUID binary’s page cache with a malicious ELF payload.
9. Root shell — Executing the corrupted SUID binary drops an interactive root shell.

The embedded ELF targets x86_64, although the underlying technique is architecture-independent.

Successful exploitation requires CONFIG_RDS, CONFIG_RDS_TCP, and CONFIG_IO_URING enabled, with io_uring_disabled=0, and a readable SUID-root binary present.

The RDS module is only enabled by default on Arch Linux among major distributions tested, though any system with RDS manually loaded remains fully at risk.

Mitigation

Administrators should apply upstream kernel patches immediately. Where patching is not feasible, or RDS is unused, according to V12 security, block the vulnerable modules to prevent loading on boot:

rmmod rds_tcp rds
printf 'install rds /bin/false\ninstall rds_tcp /bin/false\n' > /etc/modprobe.d/pintheft.conf

Testers are strongly warned not to leave exploited systems running, rebooting or dropping caches clears the in-memory page-cache overwrite, but leaving common SUID programs such as su, mount, or passwd serving the malicious payload cache poses a serious ongoing risk.

PinTheft arrives amid a sharp surge in Linux kernel privilege-escalation disclosures. The same week saw PoC releases for DirtyDecrypt and DirtyCBC, vulnerabilities sharing conceptual similarities with earlier high-profile flaws, including Dirty Frag, Fragnesia, and Copy Fail all exploiting complex memory-corruption primitives in core Linux networking and I/O subsystems.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.