Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

ZDI details two Linux kernel local privilege-escalation bugs

1 source · 2 articlesFirst reported Updated ()1
What's new

October 29: ZDI’s notes describe the XFRM and CIFS flaws but add no versions, fixes, or exploitation status.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ZDI published two Linux kernel local privilege-escalation advisories, with no versions, patches, or exploitation status.

On October 29, 2026, Trend Micro’s Zero Day Initiative published two Linux kernel local privilege-escalation advisories. ZDI-26-837 (CVE-2026-98231) is a use-after-free in the XFRM subsystem, rated CVSS 7.8, and requires existing low-privileged code execution. ZDI-26-836 (CVE-2026-72315) is a use-after-free in the CIFS file system, rated CVSS 7.2, and requires existing high-privileged code execution. ZDI did not state affected versions, fixes, or whether either flaw has been exploited.

Key facts
  • ZDI-26-837 is CVE-2026-98231, an XFRM use-after-free rated CVSS 7.8.
  • XFRM exploitation requires existing low-privileged local code execution.
  • ZDI-26-836 is CVE-2026-72315, a CIFS use-after-free rated CVSS 7.2.
  • CIFS exploitation requires existing high-privileged code execution.
  • ZDI gave no affected versions, patches, or exploitation status.
Analyze CVE-2026-98231 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026ZDI publishes XFRM and CIFS privilege-escalation advisories · ZDI Published Advisories

What each outlet adds

beyond the shared facts
  • ZDI Published AdvisoriesXFRM advisory ZDI-26-837, CVE-2026-98231, CVSS 7.8, low-privilege precondition.
  • ZDI Published AdvisoriesCIFS advisory ZDI-26-836, CVE-2026-72315, CVSS 7.2, high-privilege precondition.
CVEs
CVE-2026-98231CVE-2026-72315
Products
Linux Kernel
Organizations
Zero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 1d ago ZDI Published AdvisoriesFirst report

    Linux kernel CIFS use-after-free can escalate privileges locally

    CVE-2026-72315 is rated CVSS 7.2 and requires the attacker to already run high-privileged code.

  2. · 1d ago ZDI Published Advisories

    Linux kernel XFRM use-after-free allows local privilege escalation

    ZDI rates CVE-2026-98231 at CVSS 7.8; low-privileged local code execution is required first.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-72315
Linux kernel: smb: client: fix busy dentry warning on unmount after DIO
7.8<1%
CVE-2026-98231
Use-after-free in Linux kernel XFRM device state flush
——