Local privilege escalation vulnerabilities in Linux

Re:Local privilege escalation vulnerabilities in Linux by asveikau on Wednesday November 04, 2026 @07:38PM (#50373459)

For all of my time being aware of this industry, it has generally been understood that privilege escalation bugs are common. This has always been a thing. A lot of people say, commonly and for many years, that if your security depends on there not being privilege escalation bugs, you don't have security.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by chrismarlow9 on Wednesday November 04, 2026 @07:58PM (#50373631)

This. Privilege escalation locally is almost a given in most cases.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by slipusaururgf on Thursday November 05, 2026 @01:48AM (#50375974)

Raymond Chen from OldNewThing said multiple times that the Windows security team doesnt worry to much about local privilege escalation vulns because they know there are dozens of them (well, now probably thousands).

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by IcyWindows on Thursday November 05, 2026 @10:55AM (#50380715)

Huh? There are many posts about triaging potential LPE reports on his blog. That would show they do take them seriously or they wouldn't waste time on them.

[ Parent | on HN ]

Re:Local privilege escalation vulnerabilities in Linux by slipusaururgf on Thursday November 05, 2026 @01:51PM (#50382853)

I didn't say they ignore them, just that they assume there are many LPE bugs and they advise people to assume full takeover after any user-level local code execution. Yes, I know about browsers and JavaScript.

[ Parent | on HN ]