Linux Detection Engineering - Local Privilege Escalation
Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.
Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.
- Seven of 13 tracked 2026 Linux LPEs share a copy-on-write/zero-copy bug class.
- Most LPEs produce a detectable flow: unprivileged process from writable path gains root.
- RefluXFS credited to LLM-assisted research involving Anthropic's Claude Mythos Preview.
- Rules published in Elastic's detection-rules and protections-artifacts repositories.
- Auditd socket, splice, bind, and execve auditing supports page-cache class detection.
- Products
- Elastic DefendAuditdRefluXFS
- Organizations
- Elastic Security LabsQualysAnthropic
- AI models
- Claude Mythos Preview
From the original article
14 min read at elastic.co
Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug pointed at different kernel interfaces. We ran the public proof-of-concept for eleven exploits and two misconfigurations, and noted which rules fired.
By Ruben Groenewoud · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.