Researchers find serious nine-year old privilege-escalation bug in Linux kernel, official patch released this week
Dan Goodin / Ars Technica :
Context & Ripple Effects
This is the second time in 2016 that researchers have pulled a years-old local privilege-escalation flaw out of the Linux kernel: January brought the disclosure of an almost three-year-old bug imperiling PCs, servers, and Android phones, and this week's finding stretches the same pattern to nine years of exposure before an official patch landed.
The arc matters because it keeps repeating — the Polkit root hole disclosed in 2022 sat unfixed for twelve years, and the later CopyFail vulnerability again let unprivileged users gain admin access while many distributions lagged on applying fixes.
First-order effects
- Any local user on an unpatched Linux system can escalate to root until distributions ship the official kernel fix released this week, putting shared servers and multi-user machines first in line for exposure.
Second-order effects
- Distribution maintainers have to backport the kernel patch into every supported release they ship, and administrators running long-lived servers face an emergency update cycle rather than a routine one.
Third-order effects
- A decade-long run of ancient privilege-escalation bugs — three years, nine years, twelve years — points at a structural gap: old kernel and system-daemon code paths go unaudited for years, so researcher-driven disclosure becomes the de facto quality control on Linux's privilege boundary.
The trend: Linux's privilege-escalation surface keeps yielding vulnerabilities a decade old by the time researchers find them, making the speed of patch distribution across distributions the real determinant of user risk.