Observed arrival · 2026-11-14
ROOTBACK, a local kernel-exploit recovery instrument
A text-first Linux tool that checks the running kernel against public privilege-escalation research and, with consent, may run selected proof-of-concept exploits to reset a local password.
- For
- Linux owners testing recovery on their own machines
- Worth noticing
- Its 39-entry snapshot separates consent-gated runnable recipes from manual entries requiring host-side control or unsuitable for recovery.
Field notes
The page says ROOTBACK reads the running kernel and compares it with a dated catalog of public privilege-escalation and guest-to-host research; detections are described as version-and-feature hypotheses, not vendor patch attestations. Its 39-entry snapshot distinguishes recipes the tool can run after consent from manual entries requiring host-side control, kernel-specific offsets, a second terminal, or cases that risk panic or denial of service rather than recovery. The page recommends keeping a console or rescue path.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue