732 Bytes of Python Just Borked Every Linux Machine on Earth…

Why It Matters

The flaw compromises the core of every modern Linux system, forcing immediate patching and highlighting AI’s growing capacity to weaponize dormant code vulnerabilities.

Key Takeaways

• Linux kernel flaw CVE‑2026‑31431 discovered by AI scanning tool
• 732‑byte Python script grants unprivileged users root via page cache
• All distributions with kernels after 2017 are vulnerable and need patches
• Exploit sold on gray market for $10k‑$7 million, now public
• CISA added CVE to KEV list; attackers already exploiting it

Summary

The video exposes a critical Linux kernel vulnerability, CVE‑2026‑31431, uncovered by an AI‑driven scanning tool. A tiny 732‑byte Python script exploits a bug in the AF_AGL interface’s handling of ONC ESN data, allowing an unprivileged local user to write four uncontrolled bytes into a read‑only file’s page cache and ultimately gain root privileges.

The flaw affects every Linux distribution whose kernel code was updated after 2017, including Ubuntu, Red Hat, Amazon Linux and Arch. Because the exploit requires local access, it is not remotely exploitable, but once an attacker obtains a foothold—via SSH, malicious software, or a compromised account—they can elevate privileges instantly. The proof‑of‑concept was priced on the gray market between $10,000 and $7 million before being released publicly for free.

CrowdStrike has confirmed active exploitation, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) list. The discovery was prompted by an AI agent that scanned for splice‑related page‑cache anomalies, completing the search in roughly one hour.

Security teams must prioritize kernel updates across all Linux assets and reassess their threat models to account for AI‑generated exploits. The episode underscores the accelerating role of automated code analysis in weaponizing long‑standing bugs, demanding faster patch cycles and stronger isolation of privileged interfaces.

Original Description

CodeRabbit's new Slack Agent lets you manage your team's agentic workflow right in Slack - https://coderabbit.link/fireship-agent

A 100% reliable logic flaw was discovered in the Linux kernel and an AI tool wrote an exploit for it that affects every Linux machine updated since 2017. Let's look at the technical details behind the vulnerability and what to do if you're affected...

#coding #programming #linux #python

Want more Fireship?

🗞️ Newsletter: https://bytes.dev

🧠 Courses: https://fireship.dev