PinTheft Linux kernel vulnerability mitigation

A local privilege escalation (LPE) security vulnerability in the Linux kernel, codename “PinTheft,” was publicly disclosed on May 19, 2026. The vulnerability was fixed in the mainline Linux kernel tree. A proof-of-concept exploit was published along with public disclosure. This has been assigned the CVE ID CVE-2026-43494; other discovering teams may have given this issue other names. Ubuntu installations are only impacted if they use RDS (Reliable Datagram Sockets), a protocol generally used for high-performance computing (HPC). The default Ubuntu configuration disables the automatic loading of the module affected by this vulnerability. Linux kernel package updates that fix the vulnerability are available.

The vulnerability is a reference count bug that allows poisoning the page cache with malicious contents, similar to Copy Fail (CVE-2026-31431) or Dirty COW (CVE-2016-5195).

The vulnerability has been assigned a CVSS 3.1 score of 7.8, corresponding to a High severity. Prior to the CVSS score being published, Canonical had assessed the vulnerability identically, with a CVSS 3.1 score of 7.8. The Ubuntu Priority assigned is Medium, the local privilege escalation to root from unprivileged users is balanced against the default configuration of Ubuntu being safe against this issue. Ubuntu uses a /etc/modprobe.d/blacklist-rare-network.conf configuration file that disables rarely used network protocols, including the affected RDS.

Impact

The vulnerability allows an attacker to replace the in-memory contents of arbitrary files. The disk contents are not affected, but programs that read a file, make changes, and write the data back may make the changes persistent.

The published proof of concept exploit rewrites a setuid executable with a very short program that grants root privileges to an unprivileged local user with very high reliability.

 The impact of the vulnerability is unclear in containerized environments. It’s possible that an attacker in a container cannot use this to escape the container themselves, but could corrupt data for other containers or the main host, and if the raw storage for files is shared, could choose their targets.

Affected releases

Linux kernel security updates are available for all affected releases.

The default configuration of all Ubuntu releases is not affected, either because the relevant kernels do not have the issue, or because the issue is mitigated in the shipped configuration.

Ubuntu kernel images for 16.04 LTS and earlier do not have the issue.

Ubuntu kernel images on Focal Fossa (20.04 LTS) and later are affected. Ubuntu Bionic Beaver (18.04 LTS) only has the vulnerable code on the HWE kernel versions (5.4).

In Ubuntu, the vulnerability is distributed through the Linux kernel image packages. Prior to the Linux kernel security update being made available, the default Ubuntu configuration was not affected because it disables the vulnerable kernel module from automatically loading. This default mitigation impacts programs that use RDS networking. Users that need this functionality would have to explicitly load the rds module, a configuration that would allow this vulnerability to be exploited.

How to check if you are impacted

If you can update the Linux kernel

We always recommend that you apply security updates when available. A fix for this vulnerability is available as a Linux kernel update, even if default configurations are not impacted.

On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above.

uname -r

The list of installed kernel packages can be obtained using the following command:

dpkg -l 'linux-image*' | grep ^ii

If you cannot update the Linux kernel

These instructions are only applicable if you cannot update the Linux kernel version that fixes this vulnerability.

Confirm that the rds module is not currently loaded:

lsmod | grep -qE '^rds ' && echo "Module is loaded (vulnerable)" || echo "Module is NOT loaded"

Ensure that the automatic loading of the module is disabled:

grep -rqE '^alias net-pf-21 off' /etc/modprobe.d/ && echo "Automatic loading disabled (NOT vulnerable)" || echo "Automatic loading possible (vulnerable)"

Ensure that the module is not loaded at boot time:

grep -rqE '^rds' /etc/modules-load.d/ /usr/lib/modules-load.d/ && echo "Module is loaded at boot time (vulnerable)" || echo "Module is not loaded at boot time (NOT vulnerable)"

Security updates

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade

If this is not possible and the Linux kernel is installed via a meta package, its update can be targeted directly:

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgrade

Once the security updates for the Linux kernel are installed, a reboot is required:

sudo reboot

The unattended-upgrades feature is enabled by default for Ubuntu 16.04 LTS onwards. This service:  

• Applies new security updates every 24 hours automatically.
• If you have this enabled, the patches above will be automatically applied within 24 hours of being available, but a reboot is still required.

Manual mitigation

Update: Linux kernel security updates that fix the vulnerability are now available. The mitigations described in this section are no longer needed and should only be applied if the Linux kernel cannot be updated. If you have previously configured the mitigations, please follow the instructions in the ‘Disabling the mitigation’ section below.

No manual mitigation is necessary on default Ubuntu systems. If you previously enabled RDS on your systems, you may disable it from automatically loading again via:

rmmod rds
echo "alias net-pf-21 off" | sudo tee /etc/modprobe.d/blacklist-rds.conf

Disabling the mitigation

Once kernel updates are available and installed, the mitigation can be removed if you must run RDS applications:

sudo rm /etc/modprobe.d/blacklist-rds.conf

We recommend that you do not disable this mitigation unless you must run RDS. Note that, in order to enable RDS, it would be necessary to also disable the default configuration that prevents rarely used network protocols from being utilized.