ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Linux

1 mentions in 7 days · 4 in 30 days · 4 total · first seen · last

Search everything

Timeline

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated · 4d agofirst · 4d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Linux kernel developers discuss a batch of 21 local privilege escalation CVEs, including ZcopyReaper (CVE-2026-43502) in the RDS networking driver.

An oss-security thread examines newly published Linux kernel local privilege escalation issues tracked in the kernel.org security vulnerabilities git repository. CVE-2026-43502, dubbed ZcopyReaper, affects the net/rds (Reliable Datagram Sockets) subsystem. The discussion references roughly 20 additional kernel LPE CVEs published in the 2026 Q3 window.

oss-security · 7d agoVulnerabilityCVE-2026-43502

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.

Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.

oss-security · 7d agoVulnerabilityCVE-2026-43502

WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf

The Linux IIO userspace tool lsiio has a stack buffer overflow in find_type_by_name() caused by unbounded fscanf reads of oversized filesystem-backed attribute values.

A stack-based buffer overflow exists in the Linux Industrial I/O (IIO) userspace utility lsiio. In the find_type_by_name() function, the program reads an unbounded string from a filesystem-backed attribute into a fixed-size stack buffer using fscanf("%s", ...). A crafted or oversized attribute value causes a write beyond the bounds of the destination buffer. Despite the title's reference to WireGuard-Linux, the flaw described is in the IIO lsiio utility.

Full Disclosure · 11d agoVulnerability

Related CVEs

  • CVE-2026-435027.8<1%
    In the Linux kernel, the following vulnerability has been resolved:
    In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge()…
    · linux linux kernel—
  • CVE-2026-314317.8100%
    Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
    CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
    · Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass
  • CVE-2026-432848.893%
    Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
    CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred.
    · Linux kernelmass
  • CVE-2026-463007.89%
    In the Linux kernel, the following vulnerability has been resolved:
    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags…
    · linux linux kernel—

Appears with

product Linux kernel 2organization kernel.org 1organization Nozomi 1organization oss-security 1product KATARU 1product Linux IIO lsiio 1product Mirai 1product openSUSE 1vendor Nozomi 1vendor OpenWrt 1malware KATARU 1vendor WireGuard 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.