Researchers find serious nine-year old privilege-escalation bug in Linux kernel, official patch released this week
Lurking in the kernel for nine years, flaw gives untrusted users unfettered root access. — A serious vulnerability that has been present for nine years in virtually …
Context & Ripple Effects
This is the second kernel-level privilege-escalation disclosure Ars Technica has covered in 2016: nine months after researchers disclosed an almost three-year-old escalation bug imperiling PCs, servers, and Android phones, this one turns out to have been lurking for nine years across virtually every deployment. The official patch landing this week is the fix, but the exposure window predates it by nearly a decade.
The story also fits a longer arc the coverage keeps returning to: the 12-year-old Polkit flaw with an exploit already out in 2022 and the more recent CopyFail vulnerability that many distributions had yet to patch show the same class of bug — unprivileged users reaching root through code nobody re-audited — resurfacing roughly every few years.
First-order effects
- Distro maintainers and administrators of multi-user systems must apply this week's official patch immediately, because any untrusted local account on an unpatched machine can escalate to unfettered root access.
- Shared-hosting providers and any environment that grants shell access to strangers are the most directly exposed population, since the flaw requires only local user access.
Second-order effects
- Downstream distributors running long-lived enterprise kernels face the backport burden again, deciding how far back to carry the fix for customers who cannot reboot into a new kernel.
- Each disclosure raises the reputational cost of 'stable' branches, pushing vendors to fund proactive auditing of old kernel code paths rather than waiting for researcher reports.
Third-order effects
- If the pattern holds — a nine-year-old kernel bug here, twelve years in Polkit there — the structural lesson is that Linux's attack surface includes decades-old code paths that routine review never reaches, making systematic tooling-assisted audits, not ad hoc patches, the durable defense.
- Recurring local-root findings also sharpen the split between single-user desktops and multi-tenant servers, where the practical severity of every one of these bugs concentrates.
The trend: Linux security is being shaped less by new vulnerabilities than by researchers repeatedly excavating decade-old local privilege-escalation flaws that upstream review missed.