Researchers from the V12 security team have released a proof-of-concept exploit for “PinTheft,” a newly patched Linux local privilege escalation vulnerability affecting the kernel’s Reliable Datagram Sockets (RDS) subsystem allowing attackers to gain root privileges under specific conditions. The flaw stems from a double-free and reference-counting bug in the rds_message_zcopy_from_user() zerocopy send path, enabling attackers to abuse io_uring fixed buffers to overwrite the page cache of SUID-root binaries and execute malicious payloads as root. The exploit repeatedly triggers failed zerocopy sends to steal FOLL_PIN references while io_uring retains stale page pointers, ultimately allowing page cache manipulation and root shell access. The publicly released PoC automatically targets common SUID-root binaries such as su, passwd, mount, and pkexec before launching the full exploitation chain. Exploitation requires several narrow preconditions, including enabled CONFIG_RDS and CONFIG_RDS_TCP support, active io_uring functionality, x86_64 architecture support, and kernel version 6.13 or later. Researchers noted that Arch Linux is particularly exposed because the RDS module is enabled by default, while most mainstream Linux distributions are not vulnerable right out of the box. The disclosure comes amid a broader surge of Linux privilege escalation flaws and public exploit releases, including DirtyDecrypt, DirtyCBC, Dirty Frag, Fragnesia, Copy Fail, and Pack2TheRoot (some which are already being actively exploited). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently added Copy Fail to its Known Exploited Vulnerabilities (KEV) catalog mandating all federal agencies to remediate affected systems within two (2) weeks. CTIX analysts urge administrators to apply kernel patches immediately and disable or blacklist the rds and rds_tcp modules where unnecessary.