CVE-2026-31431. 100% Reliable Linux LPE — no race, no per-distro offsets, page-cache write that bypasses on-disk file-integrity tools and crosses containers. Found by Xint Code.
In order to use this exploit you need a program that has UID bit set and the file owned by the user you want to use itheir privilages.
For example su (among other commands) has that UID bit set and because the owner of the file is root then when you execute it, it always runs with root privileges
Most Android devices use SELinux (Security Enhanced Linux) which is configured in such way that you couldn’t have root access even if you could run a program owned by root and has the UID bit set.
What you could do - in theory - is finding a process already running with root privileges and happened to be executing certain command periodically. you could then override that certain program in cache using this exploit to do what you want.
Does it have to actually be su? Couldn’t this replace any other existing privileged program with the fake su in theory?
In order to use this exploit you need a program that has UID bit set and the file owned by the user you want to use itheir privilages.
For example su (among other commands) has that UID bit set and because the owner of the file is root then when you execute it, it always runs with root privileges
Most Android devices use SELinux (Security Enhanced Linux) which is configured in such way that you couldn’t have root access even if you could run a program owned by root and has the UID bit set.
What you could do - in theory - is finding a process already running with root privileges and happened to be executing certain command periodically. you could then override that certain program in cache using this exploit to do what you want.