PinTheft Linux Vulnerability Let Attackers Gain Root Access

Cybersecuritynews •Guru Baran • May 20, 2026

A proof-of-concept (PoC) exploit was published for a new Linux Local Privilege Escalation (LPE) vulnerability dubbed “PinTheft.” Discovered by Aaron Esau of the V12 security team, the flaw allows local attackers to gain root access by exploiting an RDS zerocopy double-free bug. A kernel patch is currently available, prompting the researchers to release their PoC […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New PinTheft Vulnerability Exposes Arch Linux to Root Escalation Attacks A newly discovered Linux privilege escalation vulnerability, named PinTheft, allows local attackers to gain root access on Arch Linux systems by exploiting a flaw in the RDS subsystem. The vulnerability, identified by the V12 security team, involves a zerocopy double-free bug that can be exploited through a proof-of-concept (PoC) exploit released on May 20, 2026. This flaw requires specific conditions, including the RDS module being enabled, io_uring API support, and a readable SUID-root binary, limiting its attack surface. Users of Arch Linux are particularly at risk, as the RDS module is enabled by default on this distribution. Security experts recommend immediate kernel updates to mitigate the risk. The release of this exploit follows a trend of recent Linux local privilege escalation vulnerabilities, with several others disclosed in the past weeks. The Cybersecurity and Infrastructure Security Agency (CISA) has also issued warnings regarding similar vulnerabilities being actively exploited. Organizations are urged to patch their systems promptly to prevent potential attacks. 4 sources 71

Extracted Entities

PinTheft Linux Vulnerability Let Attackers Gain Root Access

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)