Research

Linux Detection Engineering - Local Privilege Escalation

Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug pointed at different kernel interfaces. We ran the public proof-of-concept for eleven exploits and two misconfigurations, and noted which rules fired.

Read at Elastic Security Labs

EPSS

0.16 (p97)

Exploitation

public exploit code reported

• Elastic Security Labs (elastic.co)
• CVE-2026-64600 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-31431 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-43284 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-43500 on this site · NVD · CVE.org · Vulnpedia
• CVE-2026-46300 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 79
   Tenable research Tenable 2d ago

   php2shell one week later: Why one exploit doesn’t work everywhere

   Exploited CVSS 9.2 EPSS 0.16 Fix available CVE-2026-109618CVE-2026-109619CVE-2021-44228+1 more PHP
2. 31
   News The Register 2d ago

   Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

   EPSS 0.16 CVE-2026-109618CVE-2026-109619CVE-2026-46300 PHP
3. 33
   ICS advisory CISA ICS 2d ago

   Hitachi Energy CoreTec Product

   CVE-2026-13162CVE-2026-43284 Hitachi Energy
4. 66
   CISA alert CISA 3d ago

   CISA Adds Two Known Exploited Vulnerabilities to Catalog

   Exploited EPSS 0.16 CVE-2026-41709CVE-2026-46300 VMware (Broadcom) Linux kernel
5. 86
   KEV CISA KEV 4d ago

   Linux Kernel Missing Initialization of a Variable Vulnerability

   KEV · due 31 Oct 2026 (overdue) EPSS 0.16 Fix available CVE-2026-46300 Linux kernel
6. 68
   Tenable research Tenable 10d ago

   php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

   Exploited CVSS 9.2 EPSS 0.16 No fix yet CVE-2026-109618CVE-2026-109619CVE-2026-46300+5 more PHP
7. 26
   CISA advisory CISA 22 Sep 2026

   Siemens SIPLUS and SIMATIC Products

   CVSS 3.1 Fix available CVE-2026-31431 Siemens
8. 32
   CISA advisory CISA 17 Sep 2026

   ABB Ability Edgenius

   CVSS 3.1 Fix available CVE-2026-31431 Linux kernel ABB
9. 15
   CISA advisory CISA 13 Aug 2026

   Hitachi Energy APM Edge Product

   CVSS 3.1 CVE-2026-43284CVE-2026-43500 Hitachi Energy
10. 16
    CVE NVD 27 Jul 2026

    In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores…

    Fix available CVE-2026-64531 Linux kernel
11. 14
    Advisory MSRC 24 Jul 2026

    CVE-2026-64600 xfs: resample the data fork mapping after cycling ILOCK

    CVE-2026-64600 Microsoft
12. 16
    CVE NVD 23 Jul 2026

    In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK…

    Fix available CVE-2026-64600 Linux kernel
13. 32
    CISA advisory CISA 14 Jul 2026

    ABB Ability Edgenius

    CVSS 3.1 Fix available CVE-2026-31431 Linux kernel ABB
14. 8
    Advisory MSRC 9 Jul 2026

    CVE-2026-46331 net/sched: fix pedit partial COW leading to page cache corruption

    CVE-2026-46331 Microsoft
15. 51
    CISA advisory CISA 23 Jun 2026

    Impact of Linux Kernel vulnerabilities on B&R products

    PoC public CVSS 3.1 EPSS 0.16 CVE-2026-31431CVE-2026-43284CVE-2026-46333+2 more Linux kernel ABB
16. 30
    Advisory Fortinet PSIRT 3 Jun 2026

    Linux Kernel vulnerability Dirty Frag

    CVSS 3.0 Fix available CVE-2026-43284CVE-2026-43500 Fortinet Linux kernel
17. 33
    Research Datadog Security Labs 28 May 2026

    From Exploit Code to Production Detection: Building a CVE-2026-31431 (Copy Fail) detection with Agents

    PoC public CVE-2026-31431 Datadog
18. 24
    Advisory Fortinet PSIRT 13 May 2026

    Linux Kernel Vulnerability copy.fail - CVE-2026-31431

    CVSS 3.0 Fix available CVE-2026-31431 Fortinet Linux kernel
19. 27
    Research Elastic Security Labs 9 May 2026

    Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild

    CVE-2026-31431 Linux kernel Elastic
20. 25
    Wiz Research Wiz 8 May 2026

    Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC

    No fix yet CVE-2026-43284CVE-2026-43500 Linux kernel