Re:Local privilege escalation vulnerabilities in Linux
by __d on Thursday November 05, 2026 @05:52AM
(#50377662)
I am kinda expecting the second coming of unikernels.
The reduction in both attack surface and depth seems likely to be useful.
Re:Local privilege escalation vulnerabilities in Linux
by mike_hearn on Thursday November 05, 2026 @05:58AM
(#50377701)
Why would unikernels fix this? They don't even attempt privilege separation at all.
Re:Local privilege escalation vulnerabilities in Linux
by muvlon on Thursday November 05, 2026 @08:18AM
(#50378740)
Exactly. Anybody deploying Linux today in scenarios where you might replace it with a unikernel is already not affected by LPE. They have a kernel running in a VM with one user and one application, in essence using Linux as a sort of bloated unikernel.
Re:Local privilege escalation vulnerabilities in Linux
by __d on Thursday November 05, 2026 @04:15PM
(#50384549)
Because 50m lines of code with whatever defect density is a lot more defects than a dedicated app+kernel with just the code that you need. So much of the Linux kernel is unused by any given application: why have that code loaded and runnable?
Your http proxy and your web server don't need a shell, drivers for wifi, mail daemons, systemd, python, PHP, perl, docker, multiple users, hell it might not even need a file system.
You can ship a stripped down docket image running on a stripped down Linux distro, but that still ships the entire kernel with a huge amount of functionality you don't need that may be exploited.