ThreatCluster

CentOS 9 Vulnerability Allows Privilege Escalation to Root

First seen 6 Feb 2026, 11:13 UTC • •59

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A critical use-after-free vulnerability in the Linux kernel's sch_cake Qdisc affects CentOS 9, enabling local users to escalate privileges to root. The flaw was disclosed by SSD Secure Disclosure on February 5, 2026, and was recognized as a top vulnerability in the Linux category at TyphoonPWN 2025.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 193d ago How this analysis works

More articles in this cluster (3)

Threat Graph

8 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1068 - Exploitation for Privilege Escalation

Organization (1)

SSD Secure Disclosure

Affected Platform (3)

CentOS
CentOS 9
Linux

Relationships

Data Breach targets CentOS
Data Breach targets CentOS 9
Data Breach targets Linux
Malware targets CentOS
Malware targets CentOS 9
Malware targets Linux
Zero-day Exploit targets CentOS
Zero-day Exploit targets CentOS 9
Zero-day Exploit targets Linux
T1068 - Exploitation for Privilege Escalation targets CentOS
T1068 - Exploitation for Privilege Escalation targets CentOS 9
T1068 - Exploitation for Privilege Escalation targets Linux
Data Breach related to SSD Secure Disclosure

Following this threat?

Track SSD Secure Disclosure in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…