CVE-2026-53365: VsockDrop PoC Enables Unprivileged Local Privilege Escalation

TL;DR

A researcher released VsockDrop, a proof-of-concept exploit for CVE-2026-53365 in the Linux kernel. The flaw enables unprivileged local privilege escalation to root through the vsock zerocopy send path. It needs no user namespaces and runs from a single static binary. Upstream fixed the bug, and NVD rates it 5.5.

Why It Matters

Most kernel exploits need a race window or a kernel-specific offset. VsockDrop needs neither. Instead, it uses a fixed, deterministic decrement that works across many kernels.

The exploit requires no elevated rights to start. Therefore, any local user who can open an AF_VSOCK socket can attempt unprivileged local privilege escalation. That low bar makes shared and multi-tenant hosts a clear concern.

How the Attack Works

The bug lives in the io_uring zerocopy send path, reachable over AF_VSOCK. When a large message splits into multiple socket buffers, the kernel mishandles reference tracking on pinned pages.

As a result, a completion path runs put_page() on a page it should never touch. Each send drops the pin count by one. After enough sends, the still-pinned page reaches zero and gets freed.

Next, the researcher reclaims that freed page as the page-cache for /usr/bin/su. The exploit then rewrites the program interpreter string in that page. Finally, running the setuid su binary launches an attacker loader with root credentials. Notably, this is a data-only attack with no kernel code execution and no memory leak to the attacker.

Affected Versions

The flaw affects Linux kernels from 6.7 through 7.0.10. The bug entered in 6.7 and was fixed in 7.0.11.

The VsockDrop proof-of-concept for CVE-2026-53365 was tested on unpatched Ubuntu 22.04 HWE, 24.04, and 26.04, plus Debian 13, Arch, and openSUSE Leap and Tumbleweed. Public trackers note that stable branches such as 6.12 may still lack a shipped backport.

Patch and Mitigation Steps

First, update to a kernel that carries the fix, such as 7.0.11, 6.18.34, or 7.1. Check for a vendor backport if you run an LTS branch.

Until you patch, restrict local access on shared hosts. You can also limit exposure of the virtio vsock transport where workloads do not need it. No in-the-wild exploitation of CVE-2026-53365 has been confirmed. Even so, the public VsockDrop release makes prompt patching the safer path.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.