PinTheft is a Linux local privilege escalation exploit targeting a double-free vulnerability in the RDS zerocopy send path. The flaw occurs when user pages are pinned during zerocopy sends, and subsequent page faults lead to duplicate page reference drops during error handling and message cleanup. This allows reference count manipulation via io_uring fixed buffers to overwrite page cache contents, enabling privilege escalation by modifying a SUID-root binary.
| Vendor | Product | Versions |
|---|---|---|
| linux | rds kernel module | — |
