Linux Detection Engineering - Local Privilege Escalation

**Executive summary:** This report examines a 2026 surge of Linux local privilege escalation (LPE) disclosures and PoCs, characterizes the common exploit flow (unprivileged exec from writable path followed by uid_change to 0 or SUID helper abuse), and presents a layered detection framework using Elastic Defend and auditd that combines outcome-oriented rules with per-technique rules to detect page-cache/zero-copy corruption families, namespace-based attacks, trusted-helper abuse, and misconfigured SUID/SGID binaries.