Researchers disclose an almost three year old privilege escalation bug in the Linux kernel that imperils millions of PCs, servers, and Android phones
Linux bug imperils tens of millions of PCs, servers, and Android phones — Vulnerability allows restricted users and apps to gain unfettered root access.
Context & Ripple Effects
This disclosure is an early entry in what became a running series for Ars Technica: long-lived Linux kernel flaws that grant root access surfacing years after the vulnerable code shipped. Later that same year researchers found a nine-year-old kernel privilege-escalation bug, and a decade on the pattern repeated with the CopyFail vulnerability, where patches existed but many distributions had yet to apply them.
First-order effects
- Any restricted user or app on an unpatched PC, server, or Android phone can escalate to unfettered root access, so distributors and device makers must ship kernel updates across tens of millions of machines.
Second-order effects
- Android's fragmented update pipeline becomes the weak link: as CopyFail later showed, even released fixes reach many devices slowly, leaving phones exposed long after the upstream patch exists.
Third-order effects
- If the pattern holds — old kernel code repeatedly yielding privilege-escalation bugs — the industry's exposure shifts from finding flaws to distributing fixes, pressuring vendors toward faster, more automatic update delivery.
The trend: The Linux kernel's aging codebase keeps producing multi-year-old privilege-escalation bugs, turning patch distribution rather than vulnerability discovery into the binding constraint on device security.