Skip to main content
Unlike the misconfiguration techniques on the Privilege Escalation page, everything here only works against a specific, unpatched version of the kernel or a piece of privileged software. Confirm the version first, every exploit below is wasted effort against a patched system, and a kernel exploit misfiring can crash the box outright.
1

Get the exact kernel and distro version

2

Check it against a known list of exploits before trying anything by hand

3

Compile on a matching system when possible

Compiling directly on the target is simplest and guarantees ABI compatibility, if that’s not possible, matching the target’s glibc/kernel headers version elsewhere (a Docker container pinned to the same distro release works well) avoids exploits that compile fine but crash on the mismatch.
Every exploit on this page can panic or hang the kernel if the version match isn’t exact or the target is patched. Confirm scope and have a way to recover (snapshot, support contact, reboot access) before running any of these outside a disposable lab.

​
Dirty Frag (CVE-2026-43284, CVE-2026-43500)

Two separate bugs, one in the xfrm-ESP (IPsec) subsystem and one in RxRPC, that both let an unprivileged user corrupt the page cache the same way. Chained together, they let an attacker overwrite the on-disk content of a cached file, including a cached SUID binary, bypassing normal file permission checks entirely. All current Ubuntu releases were confirmed affected, a public PoC was released within days of disclosure.
Writeup

​
”Copy Fail” (CVE-2026-31431)

A logic flaw in the kernel’s algif_aead crypto module (the AF_ALG AEAD path), present since a 2017 optimization that let source and destination scatter-gather lists share memory pages. Chaining it with splice() gives an unprivileged user a controlled 4-byte write into a file’s page-cache backing, overwriting a cached SUID binary like /usr/bin/su gets arbitrary code executed as root on its next run. Works as a container escape too, since the page cache is shared with the host kernel. Affects kernels through 6.18.21, fixed in 6.18.22/6.19.12/7.0.

​
nf_tables Catch-All Use-After-Free (CVE-2026-23111)

Caused by a single inverted character in a conditional check inside nf_tables, the upstream fix was a one-line change. Triggerable by any unprivileged user when nf_tables is enabled and unprivileged user namespaces are available, both the default on most current distros. Public exploits followed disclosure within weeks, confirmed working against Debian Bookworm/Trixie, Ubuntu 22.04/24.04 LTS, and RHEL 10.
Technical writeup

​
nf_tables Anonymous Set Use-After-Free (CVE-2023-32233)

A use-after-free in nf_tables anonymous sets, temporary workspaces that are supposed to be cleared after use but, due to a reference-counting bug, can still be accessed and manipulated afterward. Affects kernels up to 6.3.1.

​
CVE-2022-25636 (netfilter nf_dup_netdev)

A heap out-of-bounds write in net/netfilter/nf_dup_netdev.c, affecting kernels 5.4 through 5.6.10. Nick Gregory’s write-up covers the discovery in detail.

​
Dirty Pipe (CVE-2022-0847)

Conceptually similar to Dirty Cow but newer and more reliable, a flaw in the Linux pipe implementation lets a user with only read access to a file overwrite its contents anyway, including files owned by root. Affects kernels 5.8 through 5.17.

​
PwnKit / Polkit (CVE-2021-4034)

A memory corruption bug in pkexec (part of Polkit), present for over a decade before being disclosed and patched in January 2022. Works out of the box on most unpatched distros, pkexec is installed and SUID by default almost everywhere.

​
CVE-2021-22555 (netfilter)

A heap out-of-bounds write in the netfilter subsystem, affecting kernels 2.6 through 5.11.

​
Sudo Heap Overflow / Baron Samedit (CVE-2021-3156)

A heap-based buffer overflow in sudo itself, triggered without needing any sudo rule at all, just local shell access. Affects sudo 1.8.31 (Ubuntu 20.04), 1.8.27 (Debian 10), and 1.9.2 (Fedora 33), among others.
Build errors from a glibc/gcc version mismatch are common when compiling off-target, running the build inside a matching Ubuntu 20.04 container sidesteps most of them. A Python implementation is also available if the C version won’t compile at all.

​
Dirty Cow (CVE-2016-5195)

One of the most well-known Linux kernel privilege escalation bugs, a race condition in how the kernel’s memory subsystem handles copy-on-write, lets a user overwrite memory mapped as read-only. Affects essentially every kernel from 2007 until the October 2016 patch.
Proof-of-concept collection

​
Screen 4.5.0 (GNU)

An older but still occasionally encountered privilege escalation in screen version 4.05.00.
Exploit-DB entry · Alternative PoC

​
Quick Reference Tools

linux-exploit-suggester

Matches the running kernel against known exploits automatically, always run this before searching manually.

Linux Privilege Escalation

Misconfiguration-based techniques that don’t depend on a specific vulnerable version.