Search: “linux kernel”

USN-8729-1: Linux kernel vulnerabilities

Ubuntu issued USN-8729-1 fixing Linux kernel vulnerabilities across ARM, Bluetooth, GPU, SCSI, SMB, and Azure MANA subsystems.

Ubuntu released USN-8729-1 addressing several security issues discovered in the Linux kernel that could allow an attacker to compromise the system. Fixes span ARM32/ARM64/PowerPC architectures, Bluetooth, GPU, InfiniBand, and network drivers, plus the Microsoft Azure Network Adapter (MANA) driver. The update also corrects flaws in the SCSI and SPI subsystems, SMB and NTFS3 file systems, EFI core, and file systems infrastructure.

Ubuntu Security Notices·Sep 7, 09:08 UTC · 9d agoAdvisory 6 sources

ZDI-26-699: Linux Kernel NTFS3 Out-of-Bounds Read Information Disclosure Vulnerability

ZDI-26-699: Linux Kernel NTFS3 out-of-bounds read (CVSS 5.2) lets local low-privileged attackers disclose sensitive information.

ZDI advisory ZDI-26-699 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 5.2. An attacker must already have the ability to execute low-privileged code on the target system to trigger the flaw. Successful exploitation results in information disclosure. No CVE identifier is listed in the advisory.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerability 3 sources

USN-8730-2: Linux kernel (Azure) vulnerability

Ubuntu fixes a Linux kernel (Azure) vulnerability in the IPv6 networking and Netfilter subsystems.

Ubuntu security notice USN-8730-2 corrects a security issue in the Linux kernel Azure flavor affecting the IPv6 networking and Netfilter subsystems. An attacker could possibly use the flaw to compromise the system.

Ubuntu Security Notices·Sep 15, 09:41 UTC · 23h agoAdvisory 2 sources

Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.

CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.

GBHackers·Sep 15, 08:18 UTC · 1d agoExploit / PoCCVE-2026-43502CVE-2026-43501CVE-2026-43074+4 CVEs

ZDI-26-696: Linux Kernel NTFS3 Journal Heap-based Buffer Overflow Code Execution Vulnerability

ZDI-26-696: Linux Kernel NTFS3 journal heap-based buffer overflow (CVE-2026-72196, CVSS 8.8) enables local arbitrary code execution.

ZDI advisory ZDI-26-696 describes a heap-based buffer overflow in the Linux Kernel NTFS3 journal handling, tracked as CVE-2026-72196 with a CVSS score of 8.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to execute arbitrary code. No in-the-wild exploitation is mentioned.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-721961

ZDI-26-682: Linux Kernel IPv6 Neighbour Discovery Uninitialized Memory Information Disclosure Vulnerability

ZDI discloses an uninitialized-memory flaw in Linux kernel IPv6 neighbor discovery (CVE-2026-43040, CVSS 6.0) allowing information disclosure by already-privileged local attackers.

ZDI advisory ZDI-26-682 describes an uninitialized memory vulnerability in the Linux kernel's IPv6 Neighbour Discovery code, tracked as CVE-2026-43040 with a CVSS score of 6.0. Exploitation requires the attacker to already execute high-privileged code on the target, which severely limits practical impact to kernel memory information disclosure. No active exploitation is mentioned.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-430401

U.S. CISA adds ownCloud, Linux Kernel, and JFrog Artifactory flaws to its Known Exploited Vulnerabilities catalog

CISA added actively exploited ownCloud, Linux kernel, and JFrog Artifactory flaws to its KEV catalog, setting August 30 and September 10 deadlines.

CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2023-49105 (ownCloud WebDAV improper authentication, CVSS 9.8), CVE-2026-53362 (Linux kernel IPv6 out-of-bounds write, CVSS 7.8), and CVE-2026-66384 (JFrog Artifactory path traversal, CVSS 5.3). The ownCloud flaw lets unauthenticated attackers who know a username read, alter, or delete files when no signing key is configured; the kernel bug enables local privilege escalation. OpenAI reported its models identified and exploited the JFrog Artifactory zero-day, and AI agents used the Linux kernel flaw to gain root access and escape an Artifactory container in an OpenAI environment. Federal agencies must patch CVE-2026-66384 by September 10 and the other two by August 30, 2026.

Security Affairs·Aug 28, 13:56 UTC · 18d agoExploit / PoC in the wildCVE-2023-49105CVE-2026-53362CVE-2026-663841

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

oss-security thread discusses newly disclosed Linux kernel local privilege escalations, including ZcopyReaper (CVE-2026-43502) and about 20 more flaws.

An oss-security mailing list thread discusses newly disclosed Linux kernel local privilege escalation (LPE) issues, headlined by ZcopyReaper (CVE-2026-43502) along with roughly 20 more. Discussants ask whether the many reports could be summarized and note that locking kernel module loading after boot has repeatedly proven an effective mitigation. The visible discussion does not state whether any of the flaws are exploited in the wild or give specific patch guidance beyond the individual reports.

oss-security·Sep 8, 17:02 UTC · 7d agoVulnerabilityCVE-2026-43502

Testing race conditions with memory access tracing and stack-based delay injection

Google Project Zero released MAccConc, Linux kernel tooling that traces memory accesses to explore and test race condition interleavings.

A Google Project Zero researcher published MAccConc (Memory Access Concurrency), tooling for exploring possible interleavings of multithreaded test cases in the Linux kernel, available on GitHub. The tools use KCOV with ASAN outline-mode instrumentation to record per-access memory traces, enabling automatic testing of all A-B-A interleavings plus terminal and GUI explorers for manual analysis. The work targets confirming race condition candidates, building reliable regression tests, and enabling concurrency fuzzing, drawing on ideas from SKI and Ned Williamson's sockfuzzer.

Google Project Zero·Sep 8, 07:00 UTC · 8d agoResearch1

USN-8760-1: Linux kernel (NVIDIA) vulnerabilities

Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.

Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.

Ubuntu Security Notices·Sep 15, 09:15 UTC · 1d agoAdvisory

ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability

ZDI discloses Linux Kernel usbnet driver race condition (CVE-2025-22050) enabling physically present attackers to escalate privileges without authentication.

ZDI-26-702 covers a race condition privilege escalation vulnerability in the Linux Kernel usbnet driver, assigned CVE-2025-22050 with a CVSS rating of 7.1. A physically present attacker can escalate privileges on affected installations. Authentication is not required to exploit the vulnerability.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2025-22050

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-89688

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu released USN-8748-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across networking, file system, and crypto subsystems.

Ubuntu issued security notice USN-8748-1 fixing several Linux kernel vulnerabilities affecting the NVIDIA Tegra memory controller driver, hardware crypto device drivers, and network drivers, among others. Affected subsystems include GFS2, OCFS2, and SMB file systems, B.A.T.M.A.N. meshing, Ceph, Netfilter, Open vSwitch, IPv4/IPv6, RxRPC, SCTP, and TIPC. An attacker could potentially exploit these flaws to compromise the system.

Ubuntu Security Notices·Sep 10, 15:32 UTC · 5d agoAdvisoryCVE-2026-52914CVE-2026-52931CVE-2026-52955+8 CVEs

ZDI-26-687: Linux Kernel Open vSwitch Flow Delete Use-After-Free Information Disclosure Vulnerability

ZDI discloses Linux Kernel Open vSwitch use-after-free (CVE-2026-80994) letting low-privileged local attackers disclose sensitive kernel information, CVSS 6.4.

ZDI-26-687 covers a use-after-free information disclosure vulnerability in the Linux Kernel's Open vSwitch flow deletion handling, tracked as CVE-2026-80994 with a CVSS rating of 6.4. Exploitation requires the ability to execute low-privileged code on the target system. The flaw allows local attackers to disclose sensitive information from affected installations.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-80994

ZDI-26-692: Linux Kernel eMPIA USB Device Driver Race Condition Code Execution Vulnerability

ZDI-26-692: race condition in Linux kernel eMPIA USB driver (CVE-2026-31583) lets physically present attackers execute code without authentication; CVSS 7.1.

ZDI advisory ZDI-26-692 discloses a race condition in the Linux kernel's eMPIA USB device driver that allows physically present attackers to execute arbitrary code on affected installations. Authentication is not required, but physical access to the target system is necessary. ZDI assigned a CVSS rating of 7.1 and CVE-2026-31583.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-31583

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Linux kernel developers discuss a batch of 21 local privilege escalation CVEs, including ZcopyReaper (CVE-2026-43502) in the RDS networking driver.

An oss-security thread examines newly published Linux kernel local privilege escalation issues tracked in the kernel.org security vulnerabilities git repository. CVE-2026-43502, dubbed ZcopyReaper, affects the net/rds (Reliable Datagram Sockets) subsystem. The discussion references roughly 20 additional kernel LPE CVEs published in the 2026 Q3 window.

oss-security·Sep 8, 21:32 UTC · 7d agoVulnerabilityCVE-2026-43502

ZDI-26-693: Linux Kernel ksmbd Share Configuration Race Condition Remote Code Execution Vulnerability

ZDI-26-693: authenticated race condition in Linux kernel ksmbd share configuration allows remote code execution on ksmbd-enabled systems; CVSS 8.5.

ZDI advisory ZDI-26-693 discloses a race condition in the Linux kernel's ksmbd share configuration that allows remote attackers to execute arbitrary code on affected installations. Exploitation requires authentication, and only systems with ksmbd enabled are vulnerable. ZDI assigned a CVSS rating of 8.5; no CVE is listed in the advisory text.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerability1

ZDI-26-574: Linux Kernel Net Scheduler Connection Tracking Race Condition Local Privilege Escalation Vulnerability

A race condition (CVE-2026-46319, CVSS 7.5) in the Linux kernel net scheduler connection tracking allows local privilege escalation.

ZDI advisory ZDI-26-574 documents a race condition in the Linux kernel's net scheduler connection tracking component. Local attackers who can execute high-privileged code on a target can exploit the flaw to escalate privileges. ZDI rated the vulnerability 7.5 on CVSS and assigned CVE-2026-46319.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026VulnerabilityCVE-2026-46319

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.

Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.

oss-security·Sep 8, 03:53 UTC · 8d agoVulnerabilityCVE-2026-43502

ZDI-26-691: Linux Kernel Netlink-based Wireless Configuration Integer Overflow Local Privilege Escalation Vulnerability

ZDI-26-691: integer overflow in Linux kernel netlink wireless configuration (CVE-2026-53182) allows local privilege escalation by attackers already running high-privileged code; CVSS 8.2.

ZDI advisory ZDI-26-691 discloses an integer overflow in the Linux kernel's netlink-based wireless configuration that allows local attackers to escalate privileges on affected installations. Exploitation requires the attacker to first obtain the ability to execute high-privileged code on the target system. ZDI assigned a CVSS rating of 8.2 and CVE-2026-53182.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-53182

Introducing @huggingface/kernels: 200+ WebGPU Kernels for Local AI

Hugging Face released @huggingface/kernels, a library offering 200+ WebGPU compute kernels to accelerate AI inference locally in browsers.

Hugging Face introduced the @huggingface/kernels package, bundling more than 200 optimized WebGPU compute kernels for running AI workloads locally. The release targets browser-based and on-device inference, reducing reliance on server-side compute. No article body was available beyond the title, so benchmark results and supported models are not specified.

Hugging Face Blog·Sep 1, 00:00 UTC · 15d agoAI tools & infra

ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-23413, a use-after-free in the Linux kernel net scheduler clsact qdisc allowing local privilege escalation, CVSS 8.2.

ZDI advisory ZDI-26-694 describes a use-after-free vulnerability in the Linux kernel's net scheduler clsact qdisc component. Successful exploitation allows local attackers to escalate privileges on affected installations, and ZDI assigned a CVSS score of 8.2. The flaw is tracked as CVE-2026-23413. The advisory notes an attacker must first obtain the ability to execute high-privileged code on the target system to exploit the vulnerability.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-234132

MathKernel: An evidence-aware multi-engine mathematics kernel and MCP server

MathKernel is an open-source, evidence-aware multi-engine mathematics kernel that exposes verification workflows to AI agents via an MCP server.

MathKernel, published on GitHub, is a mathematics kernel that combines multiple computation engines with evidence-aware outputs. It ships as an MCP server, enabling AI agents and coding assistants to perform and verify calculations. The project drew moderate attention on Hacker News.

Hacker News · security·Sep 7, 00:21 UTC · 9d agoAI tools & infraHN 36↑ · 5 comments

ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-575, a CVSS 7.5 TOCTOU local privilege escalation in the Linux kernel net scheduler packet classifier API.

The Zero Day Initiative disclosed a time-of-check time-of-use flaw in the Linux kernel's net scheduler packet classifier API that permits local privilege escalation. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5; no CVE id is provided in the text.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026Advisory1

ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.

ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerability

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackers·updated Sep 11, 14:17 UTC · 4d ago·first Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

MaxKernel: Agentic Kernel Generation for TPUs

Researchers open-source MaxKernel, a multi-agent LLM system that generates and optimizes TPU kernels matching expert hand-tuned baselines on JaxBench.

MaxKernel is a multi-agent system offering three paradigms for TPU kernel development: human-in-the-loop collaborative design, a fully autonomous metric/trace-driven optimization loop, and graph-based autonomous search for global exploration. All paradigms draw on a shared pool of specialized sub-agents for planning, implementation, self-debugging, testing, and hardware profiling. Evaluated on JaxBench's 50 diverse TPU kernel tasks and real-world workloads from open-source models, it consistently matches expert hand-tuned baselines. The system is open-sourced via the AI-Hypercomputer GitHub repository.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI tools & infra

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA added three actively exploited vulnerabilities to its KEV catalog: CVE-2023-49105 (ownCloud), CVE-2026-53362 (Linux kernel), and CVE-2026-66384 (JFrog Artifactory).

CISA added three new entries to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation: ownCloud improper authentication (CVE-2023-49105), an unspecified Linux kernel vulnerability (CVE-2026-53362), and JFrog Artifactory improper path restriction (CVE-2026-66384). KEV listing confirms these flaws are being exploited in the wild rather than posing theoretical risk. Under BOD 26-04, federal civilian executive branch agencies must prioritize remediation of KEV entries.

CISA Advisories·Aug 27, 12:00 UTC · 19d agoExploit / PoC in the wildCVE-2023-49105CVE-2026-53362CVE-2026-66384

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.

Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.

Help Net Security·Sep 14, 07:40 UTC · 2d agoAdvisoryCVE-2026-5928CVE-2026-5450CVE-2026-34873+17 CVEs

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security·Aug 24, 04:21 UTC · 23d agoTools1

ZDI-26-680: Linux Kernel Crypto Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses a Linux kernel crypto subsystem use-after-free (CVE-2026-31719, CVSS 8.8) letting local low-privileged attackers escalate to root.

ZDI advisory ZDI-26-680 covers a use-after-free vulnerability in the Linux kernel crypto subsystem, tracked as CVE-2026-31719 with a CVSS score of 8.8. A local attacker who can already execute low-privileged code can exploit it to escalate privileges on affected installations. The advisory does not report any exploitation in the wild.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-31719

CISOs Race to Control AI Agents Without Destroying Their Value

Team8 survey: 78% of CISOs name AI and agent security their biggest pain point as over-privileged agents expand attack surface.

Team8's annual CISO Village survey reports that 78% of security leaders cite AI and agent security as their biggest pain point, twice the second-ranked concern (39%), while 71% are experimenting with or augmenting security tools using AI agents. Team8 CISO Tim Brown warns that employee-built agents created with tools like Claude Code, Cursor and Codex can take unintended harmful actions, such as poking around production systems, because prompt imprecision combines with non-deterministic model behavior. Brown recommends building guardrails into the agent development process to limit where agents can go and what they can do, without destroying business utility. He also urges greater transparency and experience sharing among security leaders facing the same agent security problems.

SecurityWeek·Sep 14, 10:30 UTC · 1d agoAI safety & security

ZDI-26-609: Linux Kernel Net Scheduler Packet Classifier Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel net scheduler packet classifier has a use-after-free (CVSS 7.8) allowing local attackers to escalate privileges from low-privileged code.

ZDI-26-609 describes a use-after-free vulnerability in the Linux kernel's network scheduler packet classifier, with a CVSS score of 7.8. An attacker must first be able to execute low-privileged code on the target system before escalating privileges. The advisory text does not list an assigned CVE identifier.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerability

Linux Detection Engineering - Fileless Execution

Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.

Elastic Security Labs reproduced five Linux fileless execution patterns using its FENIX tooling: memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads. Each pattern is mapped to the Elastic Defend detection rules that catch it. The post is part of the team's ongoing Linux detection engineering series.

Elastic Security Labs·Sep 1, 14:26 UTC · 14d agoResearch

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds

Sysdig documents a skilled human attacker exploiting Marimo pre-auth RCE CVE-2026-39987 (CVSS 9.3), reaching an SSH bastion in eight seconds without AI tooling.

Sysdig detailed exploitation of CVE-2026-39987 (CVSS 9.3), a pre-authenticated RCE affecting all Marimo versions that came under active exploitation within hours of disclosure. A human operator used a hand-written Python script to harvest an AWS key from Secrets Manager and SSH into a bastion host in eight seconds, issuing 850+ commands over nine hours. Separately, Hunt.io disclosed an XMRig cryptomining campaign compromising 3,562 Redis servers via SLAVEOF rogue replication and AOF authorized_keys injection. Operation CameraSwarm, linked to a single operator, compromised over 14,000 Dahua IP cameras using CVE-2021-33044 and CVE-2021-33045.

The Hacker News·Sep 15, 11:52 UTC · 21h agoExploit / PoC in the wild 4 sourcesCVE-2026-39987CVE-2021-33044CVE-2021-33045

Hillingar - MirageOS Unikernels on NixOS

A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.

This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.

Lobsters · security·Sep 4, 09:17 UTC · 12d agoTools1

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.

Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.

Security Affairs·Sep 7, 17:49 UTC · 8d agoExploit / PoC in the wild

ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability

ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.

ZDI-26-689 describes a race condition information disclosure vulnerability in the Linux Kernel SCTP subsystem, assigned CVE-2026-46227 with a CVSS rating of 6.4. An attacker needs the ability to execute low-privileged code on the target system to exploit the flaw. The vulnerability exposes sensitive information from affected installations.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-46227

More than half of AI

CyberScoop·Aug 7, 17:10 UTC · Aug 7, 2026Exploit / PoC

Redtail Payload Analysis [Guest Diary], (Wed, Sep 9th)

SANS guest analyst detonated a RedTail Linux sample from a DShield honeypot, finding process masquerading as php-fpm, monitoring-kill behavior, and a TCP listener.

A DShield honeypot captured multi-architecture RedTail Linux executables (ARM, ARM64, i686, RISC-V, x86-64) deployed via shell scripts. Dynamic analysis of the UPX-packed, statically linked x86-64 sample (SHA-256 63be5f38...d35e) in an isolated Ubuntu 24.04 VM on Proxmox showed it renamed its process via prctl(PR_SET_NAME), killed a filesystem-monitoring process, and opened a TCP listening socket while surviving processes posed as php-fpm or PostgreSQL-like workers. Differential memory images pre- and post-execution were captured from the hypervisor for forensics.

SANS Internet Storm Center·Sep 10, 12:58 UTC · 5d agoMalware in the wild 2 sources1