--- title: The Linux Kernel is Falling Apart. | daily.dev description: A wave of universal local privilege escalation (LPE) vulnerabilities in the Linux kernel is being analyzed, including copy-fail, dirty frag, and bad epoll.... canonical: https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Linux Kernel is Falling Apart. | daily.dev og:description: A wave of universal local privilege escalation (LPE) vulnerabilities in the Linux kernel is being analyzed, including copy-fail, dirty frag, and bad epoll.... og:url: https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk og:image: https://api.daily.dev/og/posts/vgYqPUrNK.png og:image:alt: The Linux Kernel is Falling Apart. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Linux Kernel is Falling Apart. **[Low Level Learning](https://daily.dev/sources/lowlevellearning)** · 12 min read · 88 upvotes · 16 comments ## Summary A wave of universal local privilege escalation (LPE) vulnerabilities in the Linux kernel is being analyzed, including copy-fail, dirty frag, and bad epoll. Historically, bugs of this severity appeared once every 5-10 years (e.g., Dirty Cow, Dirty Pipe), but AI-assisted vulnerability research is accelerating discovery, with two appearing in a single week. The bad epoll bug exploits a use-after-free race condition in the epoll syscall with such a tight window that even ASAN and AI tools like Mythos failed to detect it — it was found manually by a human researcher. The broader trend is described as a 'great backlog clearing' where dormant vulnerabilities are being surfaced faster due to AI-enabled pattern recognition. The post briefly addresses whether Rust would have prevented these bugs, concluding yes in theory but noting the practical difficulty of writing kernel code in Rust. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the bad epoll vulnerability in the Linux kernel and how does it work? Bad epoll is a use-after-free vulnerability in the Linux kernel's epoll syscall, discovered around mid-July, that arises when two linked epoll objects are closed at the same time, creating a six-instruction race window where one structure is freed while the other still writes to it. Attackers turn this into an 8-byte write, then a use-after-free on a file object, exploited via a cross-cache attack to fake file contents and escalate to root. _Developers hardening Linux servers can track fast-moving kernel LPE writeups like this on daily.dev._ ### How does the copy.fail Linux kernel exploit achieve privilege escalation? Copy.fail exploits a flaw in how the kernel's crypto subsystem handles a socket type, causing four bytes to be written outside the bounds of a file's page cache entry when two file descriptors are spliced together. This lets an attacker overwrite the page cache of a file they don't own, such as /bin/su, tricking the kernel into running attacker-controlled code as root. _Engineers evaluating kernel exploit patterns can follow deep dives like this on daily.dev._ ### Would writing the Linux kernel in Rust prevent use-after-free vulnerabilities like bad epoll? Yes in principle, because Rust's ownership system enforces compile-time reference counting that prevents use-after-free bugs by design, which is central to how the language works. However, writing kernel-level code in Rust remains significantly harder than in C, which is why the Linux kernel is still largely unprotected against this class of bug. _Developers weighing Rust adoption for systems-level safety can dig into tradeoffs like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@ezpie** · 18 upvotes > I feel personally attacked with those vuln. Somebody call dario and tell him to stop fabling **@dcorto** · 13 upvotes > I don't think so... **@hexapaws** · 9 upvotes > if Linux is failing, I'll be sad. The penguin is gone. :( **@byteoutlaw** · 7 upvotes > In this case I do not think Microsoft nor Apple is free either.. > > > A.C.A.B. stands for All Computers Are Broken - in the hacker community. > > > And in the crime world, > > All cops are bastards. > > > I just wanted to say deep inside we knew this all along. I love tech but making our society so dependent on it is scary. **@danilosiqueira** · 7 upvotes > Clickbait article. Finding more bugs and addressing them is development work. Not finding bugs is the problem. ## Similar posts on daily.dev - [GitHub - J-jaeyoung/bad-epoll](https://daily.dev/posts/github---j-jaeyoung-bad-epoll-8ik6usr3n) · Lobsters · 2 upvotes · 1 comments - [“Bad Epoll” Linux Kernel Bug Lets Any User Grab Root](https://daily.dev/posts/bad-epoll-linux-kernel-bug-lets-any-user-grab-root-nfjae30jd) · Latest Hacking News · 4 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#rust](https://daily.dev/tags/rust), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Linux Kernel is Falling Apart.","url":"https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk"},"datePublished":"2026-07-15T13:09:14.909Z","dateModified":"2026-09-14T06:25:42.497Z","description":"A wave of universal local privilege escalation (LPE) vulnerabilities in the Linux kernel is being analyzed, including copy-fail, dirty frag, and bad epoll....","image":"https://i.ytimg.com/vi/BxdWlV5LI_4/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/BxdWlV5LI_4/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Low Level Learning","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Low Level Learning","logo":"https://media.daily.dev/image/upload/s--pjLyMMmx--/f_auto/v1724394406/logos/lowlevellearning","url":"https://daily.dev/sources/lowlevellearning"},"commentCount":16,"discussionUrl":"https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":88},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":16}],"keywords":"linux,rust,vulnerability","timeRequired":"PT12M","video":{"@type":"VideoObject","name":"The Linux Kernel is Falling Apart.","description":"A wave of universal local privilege escalation (LPE) vulnerabilities in the Linux kernel is being analyzed, including copy-fail, dirty frag, and bad epoll....","thumbnailUrl":"https://i.ytimg.com/vi/BxdWlV5LI_4/sddefault.jpg","uploadDate":"2026-07-15T13:09:14.909Z","duration":"PT12M","url":"https://api.daily.dev/r/vgYqPUrNK","embedUrl":"https://www.youtube.com/embed/BxdWlV5LI_4"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Low Level Learning","item":"https://daily.dev/sources/lowlevellearning"},{"@type":"ListItem","position":3,"name":"The Linux Kernel is Falling Apart."}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk","comment":[{"@type":"Comment","text":"I feel personally attacked with those vuln. Somebody call dario and tell him to stop fabling","datePublished":"2026-07-15T13:27:05.885Z","url":"https://daily.dev/posts/vgYqPUrNK#c-5UvKguoiy","author":{"@type":"Person","name":"Ezpie","url":"https://daily.dev/ezpie","image":"https://avatars.githubusercontent.com/u/104765117?v=4"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":18}},{"@type":"Comment","text":"I don’t think so…","datePublished":"2026-07-16T02:31:46.557Z","url":"https://daily.dev/posts/vgYqPUrNK#c-qIsuSGrMA","author":{"@type":"Person","name":"David C.","url":"https://daily.dev/dcorto","image":"https://media.daily.dev/image/upload/s--EPnTZZFw--/f_auto/v1784418453/avatars/avatar_tT4BuvxaHeTxyE5fH41si?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":13}},{"@type":"Comment","text":"if Linux is failing, I’ll be sad. The penguin is gone. :(","datePublished":"2026-07-16T03:06:47.595Z","url":"https://daily.dev/posts/vgYqPUrNK#c-VWi1s7aHs","author":{"@type":"Person","name":"HexaPaws","url":"https://daily.dev/hexapaws","image":"https://media.daily.dev/image/upload/s--tvr4YO6b--/f_auto/v1784860169/avatars/avatar_H0URpju3ND0pkrjj1i1mE?_a=BAMAMicg0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":9}},{"@type":"Comment","text":"In this case I do not think Microsoft nor Apple is free either…\nA.C.A.B. stands for All Computers Are Broken - in the hacker community.\nAnd in the crime world,\nAll cops are bastards.\nI just wanted to say deep inside we knew this all along. I love tech but making our society so dependent on it is scary.","datePublished":"2026-07-16T05:35:45.892Z","url":"https://daily.dev/posts/vgYqPUrNK#c-mR7OGp6Ze","author":{"@type":"Person","name":"Jacob B. Bonde","url":"https://daily.dev/byteoutlaw","image":"https://media.daily.dev/image/upload/s--veTChHK7--/f_auto/v1733220070/avatars/avatar_5cQvIZKr5tDFDotVDjulg"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}},{"@type":"Comment","text":"Clickbait article. Finding more bugs and addressing them is development work. Not finding bugs is the problem.","datePublished":"2026-07-16T20:34:58.015Z","url":"https://daily.dev/posts/vgYqPUrNK#c-OKPQHzz60","author":{"@type":"Person","name":"Danilo Siqueira","url":"https://daily.dev/danilosiqueira","image":"https://lh3.googleusercontent.com/a/ACg8ocLfq3KH247Vo8Y_W6aOe68cv02q1SwUh1oX4HfYQGYvaKDn5hrV=s96-c"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":7}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-linux-kernel-is-falling-apart--vgyqpurnk#faq","mainEntity":[{"@type":"Question","name":"What is the bad epoll vulnerability in the Linux kernel and how does it work?","acceptedAnswer":{"@type":"Answer","text":"Bad epoll is a use-after-free vulnerability in the Linux kernel's epoll syscall, discovered around mid-July, that arises when two linked epoll objects are closed at the same time, creating a six-instruction race window where one structure is freed while the other still writes to it. Attackers turn this into an 8-byte write, then a use-after-free on a file object, exploited via a cross-cache attack to fake file contents and escalate to root. Developers hardening Linux servers can track fast-moving kernel LPE writeups like this on daily.dev."}},{"@type":"Question","name":"How does the copy.fail Linux kernel exploit achieve privilege escalation?","acceptedAnswer":{"@type":"Answer","text":"Copy.fail exploits a flaw in how the kernel's crypto subsystem handles a socket type, causing four bytes to be written outside the bounds of a file's page cache entry when two file descriptors are spliced together. This lets an attacker overwrite the page cache of a file they don't own, such as /bin/su, tricking the kernel into running attacker-controlled code as root. Engineers evaluating kernel exploit patterns can follow deep dives like this on daily.dev."}},{"@type":"Question","name":"Would writing the Linux kernel in Rust prevent use-after-free vulnerabilities like bad epoll?","acceptedAnswer":{"@type":"Answer","text":"Yes in principle, because Rust's ownership system enforces compile-time reference counting that prevents use-after-free bugs by design, which is central to how the language works. However, writing kernel-level code in Rust remains significantly harder than in C, which is why the Linux kernel is still largely unprotected against this class of bug. Developers weighing Rust adoption for systems-level safety can dig into tradeoffs like this on daily.dev."}}]} ```