PoC Released for PinTheft Linux Flaw Enabling Root Privilege Escalation

A public proof-of-concept (PoC) exploit called “PinTheft” has been released for a newly disclosed Linux kernel flaw that allows local attackers to escalate privileges to root on certain systems.

PinTheft is a Linux local privilege escalation (LPE) exploit that targets a reference-counting bug in the Reliable Datagram Sockets (RDS) zerocopy send path and turns it into a page-cache overwrite using io_uring fixed buffers.

The issue stems from how the kernel function rds_message_zcopy_from_user() pins user pages one at a time and mishandles cleanup when a later page faults, leading to a double-drop of references to already-pinned pages.

Each failed zerocopy send effectively “steals” one reference from the first pinned page, creating a controlled refcount underflow condition that can be weaponized.

PinTheft Linux Flaw

The PinTheft PoC chains the RDS refcount bug with io_uring’s fixed-buffer mechanics to overwrite the page cache of a SUID-root binary and then execute a custom payload as root.

It first registers an anonymous page as a fixed buffer using io_uring, which gives the page a FOLL_PIN bias of 1024 references.

It then repeatedly triggers failing RDS zerocopy sends to consume those references while io_uring still holds a raw page pointer.

After cleanly freeing and reclaiming that physical page as the first page of a SUID-root binary in the page cache, the exploit abuses the stale io_uring fixed-buffer entry to overwrite that page cache with a small embedded ELF payload, so that executing the SUID binary yields a root shell.

Exploitation requires several narrow preconditions: the kernel must be built with CONFIG_RDS and CONFIG_RDS_TCP, and io_uring must be enabled.io_uring_disabled=0, RDS/RDS_TCP modules must be loadable, and the kernel must support the finalized IORING_REGISTER_CLONE_BUFFERS API (the public PoC targets kernel 6.13 and later).

The exploit also needs a readable SUID-root binary on x86_64 for the bundled payload and, on systems that allow module autoloading, it can request TCP transport using SO_RDS_TRANSPORT=2 to auto-load rds_tcp if present.

Researchers note that the RDS module is enabled by default on Arch Linux among the common distributions they tested, making Arch users a prime immediate target. At the same time, many other mainstream distro kernels are not exposed by default.

The V12 security team, led by researcher Aaron Esau, discovered the bug using their automated analysis platform and released a working PoC after a kernel patch became available.

The exploit code is published in the v12-security “pocs” GitHub repository under the pintheft directory, including a detailed README and the main poc.c file. On a vulnerable system, compilation and execution are straightforward, for example:

git clone https://github.com/v12-security/pocs.git && cd pocs/pintheft && gcc -o exp poc.c && ./exp

The PoC automatically searches for common SUID-root targets such as /usr/bin/su, /bin/su, /usr/bin/mount, /usr/bin/passwd, or /usr/bin/pkexec, backs up the chosen binary under /tmp/.backup_<name>_<pid>, and then performs the full exploitation chain before dropping the operator into a root shell.

Mitigation and hardening guidance

Administrators are urged to deploy the upstream kernel patch as it becomes available for their distribution, especially on systems where RDS is enabled or Arch Linux kernels are in use.

As an immediate mitigation on systems that do not require RDS, defenders can remove active modules with rmmod rds_tcp rds and block future loading by adding a modprobe rule such as printf ‘install rds /bin/false\ninstall rds_tcp /bin/false\n’ > /etc/modprobe.d/pintheft.conf.

Security teams should also review which SUID-root binaries are present and necessary on exposed hosts, and consider reducing the SUID footprint to limit the practical impact of page-cache-overwrite-style exploits.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.