This critical vulnerability in the Linux kernel allows for local privilege escalation and is currently being actively exploited in the wild.

This is a heap out-of-bounds write flaw located in the net/netfilter/x_tables.c file. The vulnerability allows an unauthenticated, local attacker to leverage user namespaces to perform memory corruption, leading to arbitrary code execution with root privileges or a denial of service.

The potential impact of this vulnerability is total system compromise. Given the CVSS score of 9.5, this flaw represents a critical threat to confidentiality, integrity, and availability. Successful exploitation enables unauthorized actors to escape containerized environments, such as Kubernetes pods, and gain full control over the underlying host system, leading to data theft and significant operational disruption.

Immediate Action: Apply patches immediately by updating to Linux kernel versions 5.12, 5.10.31, 5.4.113, 4.19.188, 4.14.231, 4.9.267, or 4.4.267.

Proactive Monitoring: Monitor system logs for unusual kernel panic events or unexpected process execution patterns that may indicate attempts to trigger heap corruption.

Compensating Controls: Restrict the creation of user namespaces for unprivileged users as a temporary measure to limit the attack surface until kernel updates can be deployed.

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Due to the confirmed active exploitation and the critical nature of the privilege escalation path, this vulnerability must be treated as a high priority for remediation. Organizations should expedite the deployment of the provided kernel updates across all affected infrastructure, particularly on host systems managing containerized workloads, to prevent unauthorized system access and potential full-scale compromise.