ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “kernels”

54 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 1341Vulnerability 1291Exploit / PoC 592Ransomware 282Threat actor 100Data breach 65Advisory 59Phishing & fraud 56Industry 53Policy & legal 42AI research 29Research 29Tools 27AI safety & security 26
SeverityAllcritical 1431high 1810medium 559low 129info 109

Android Security Update September 2026 – Fix for Critical Flaws that Enable RCE Attacks

Google's September 2026 Android bulletin fixes over 30 critical flaws, including no-interaction system RCEs, a TIPC kernel RCE and a Qualcomm closed-source bug

Google's Android Security Bulletin for September 2026 (patch levels 2026-09-01 and 2026-09-05) fixes numerous critical System remote code execution flaws, including CVE-2026-28604, CVE-2026-28618, CVE-2026-28639, CVE-2026-28662, CVE-2026-49882, CVE-2026-49884, CVE-2026-49919 and CVE-2026-49921, none requiring user interaction or additional privileges. It also addresses critical kernel issues including a TIPC RCE (CVE-2026-52993) and elevation-of-privilege flaws in NFC and protected KVM, plus a critical Qualcomm closed-source component flaw (CVE-2026-25289). Affected versions span Android 14 through 17; the 2026-09-05 patch level extends coverage to Android TV and chipset components, with high-severity fixes for Arm Mali, PowerVR, MediaTek, Unisoc and Qualcomm components.

Cyber Security News · 6d agoAdvisoryCVE-2026-28666CVE-2026-55273CVE-2026-49932+27 CVEs

USN-8726-1: Linux kernel vulnerabilities

Ubuntu issued kernel security update USN-8726-1 fixing an Arm TLB invalidation flaw (CVE-2025-10263) that enables local privilege escalation, plus other kernel fixes.

Ubuntu released USN-8726-1, a security update for the generic Linux kernel. It fixes CVE-2025-10263, where certain Arm processors complete broadcast TLB invalidation before related memory writes are globally observed, potentially letting local attackers bypass memory protections or escalate privileges. The update also addresses additional kernel flaws in ARM64, ARM32, RISC-V, S390 and other subsystems.

Ubuntu Security Noticesupdated · 9d agofirst · 9d agoAdvisory 6 sourcesCVE-2025-10263

USN-8760-1: Linux kernel (NVIDIA) vulnerabilities

Canonical issues USN-8760-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across numerous subsystems and CPU architectures.

Canonical published USN-8760-1 to correct several Linux kernel (NVIDIA) vulnerabilities that an attacker could possibly use to compromise the system. The update fixes flaws spanning UAPI, the kernel build system, ARM32, ARM64, RISC-V, S390, and x86 architectures. Patched subsystems also include the block layer, cryptographic API, Compute Acceleration Framework, Intel NPU driver, ACPI and Bluetooth drivers, and the hardware random number generator core.

Ubuntu Security Notices · 1d agoAdvisory

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security Notices · 1d agoAdvisory 2 sources

ZDI-26-683: Linux Kernel IPv6 VTI Subsystem Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-72463, a CVSS 7.5 use-after-free in the Linux Kernel IPv6 VTI subsystem enabling privilege escalation.

ZDI-26-683 covers a use-after-free in the Linux Kernel IPv6 VTI subsystem that allows local attackers to escalate privileges. Exploitation requires first obtaining the ability to execute high-privileged code on the target system, limiting practical impact. ZDI assigned a CVSS rating of 7.5 and CVE-2026-72463.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-72463

ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-64265, a CVSS 7.8 race condition in the Linux Kernel FUSE subsystem enabling local privilege escalation.

ZDI-26-681 covers a race condition in the Linux Kernel FUSE subsystem that allows local attackers to escalate privileges. Exploitation requires the ability to execute low-privileged code on the target system. ZDI assigned a CVSS rating of 7.8 and CVE-2026-64265.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-64265

ZDI-26-684: Linux Kernel KSMBD Query Directory Request Race Condition Remote Code Execution Vulnerability

ZDI discloses CVE-2026-64397, a CVSS 9.0 unauthenticated remote code execution race condition in Linux Kernel KSMBD.

ZDI-26-684 describes a race condition in the Linux Kernel KSMBD subsystem's Query Directory Request handling that allows unauthenticated remote attackers to execute arbitrary code. Only systems with KSMBD enabled are vulnerable. ZDI assigned a CVSS rating of 9.0 and CVE-2026-64397.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-64397

USN-8748-1: Linux kernel (NVIDIA) vulnerabilities

Ubuntu released USN-8748-1 patching multiple Linux kernel (NVIDIA) vulnerabilities across networking, file system, and crypto subsystems.

Ubuntu issued security notice USN-8748-1 fixing several Linux kernel vulnerabilities affecting the NVIDIA Tegra memory controller driver, hardware crypto device drivers, and network drivers, among others. Affected subsystems include GFS2, OCFS2, and SMB file systems, B.A.T.M.A.N. meshing, Ceph, Netfilter, Open vSwitch, IPv4/IPv6, RxRPC, SCTP, and TIPC. An attacker could potentially exploit these flaws to compromise the system.

Ubuntu Security Notices · 5d agoAdvisoryCVE-2026-52914CVE-2026-52931CVE-2026-52955+8 CVEs

ZDI-26-623: Linux Kernel IPv6 Multicast Routing Use-After-Free Local Privilege Escalation Vulnerability

ZDI-26-623 details a use-after-free in Linux kernel IPv6 multicast routing enabling local privilege escalation, rated CVSS 8.8.

The Zero Day Initiative published ZDI-26-623 describing a use-after-free vulnerability in the Linux kernel's IPv6 multicast routing implementation. A local attacker who can execute low-privileged code on an affected installation can exploit the flaw to escalate privileges. ZDI assigned a CVSS rating of 8.8; the advisory does not name a CVE id or state that exploitation has been observed.

ZDI Published Advisories · 7d agoAdvisory

ZDI-26-575: Linux Kernel Net Scheduler Packet Classifier API Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-575, a CVSS 7.5 TOCTOU local privilege escalation in the Linux kernel net scheduler packet classifier API.

The Zero Day Initiative disclosed a time-of-check time-of-use flaw in the Linux kernel's net scheduler packet classifier API that permits local privilege escalation. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5; no CVE id is provided in the text.

ZDI Published Advisories · Aug 13, 2026Advisory1

ZDI-26-570: Linux Kernel IGMP Subsystem Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-570, a CVSS 7.5 race condition local privilege escalation in the Linux kernel's IGMP subsystem.

The Zero Day Initiative disclosed a race condition in the Linux kernel's IGMP subsystem that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute high-privileged code on the target system. ZDI assigned a CVSS rating of 7.5 to this finding; no CVE id is stated in the advisory text.

ZDI Published Advisories · Aug 13, 2026Advisory

ZDI-26-569: Linux Kernel Net Scheduler True Link Equalizer Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-569, a CVSS 7.5 race condition local privilege escalation in the Linux kernel net scheduler true link equalizer.

The Zero Day Initiative disclosed a race condition in the Linux kernel's net scheduler true link equalizer component enabling local privilege escalation. Exploitation requires the attacker to first run high-privileged code on the target system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published Advisories · Aug 13, 2026Advisory

ZDI-26-572: Linux Kernel XFRM Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-572, a CVSS 7.5 race condition local privilege escalation in the Linux kernel's XFRM subsystem.

The Zero Day Initiative disclosed a race condition in the Linux kernel's XFRM (transform) subsystem allowing local attackers to escalate privileges. Exploitation requires the attacker to first run high-privileged code on the affected system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published Advisories · Aug 13, 2026Advisory

The September 2026 Security Update Review

ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.

The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.

Zero Day Initiative Blog · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-81963CVE-2026-70352+27 CVEs1

Heap overflow in kernel driver due to missing size validation

Fortinet fixes a CVSS 7.3 heap overflow in the FortiClient Windows kernel driver enabling code execution via crafted DNS responses.

Fortinet PSIRT advisory FG-IR-26-156, revised 2026-08-12, describes a heap-based buffer overflow (CWE-120, buffer copy without checking input size) in the FortiClient Windows kernel driver, scored CVSSv3 7.3. An unauthenticated attacker positioned to alter or craft DNS responses for a targeted host could execute arbitrary code via malicious packets. No CVE identifier or exploitation status is provided in the advisory text, so administrators should check the full bulletin for affected versions and fixed releases.

Fortinet PSIRT · Aug 12, 2026Advisory

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages

Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.

Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.

Help Net Security · 2d agoAdvisoryCVE-2026-5928CVE-2026-5450CVE-2026-34873+17 CVEs

ZDI-26-686: Linux Kernel nftables Race Condition Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-74565, a CVSS 7.8 nftables race condition letting local low-privileged attackers escalate privileges on Linux.

ZDI-26-686 describes a race condition in the Linux Kernel nftables subsystem that allows local attackers to escalate privileges. Exploitation requires the ability to execute low-privileged code on the target system. ZDI assigned a CVSS rating of 7.8 and CVE-2026-74565.

ZDI Published Advisories · 2d agoAdvisoryCVE-2026-74565

Apple Releases iOS 27 Security Update to Fix Over 120 Vulnerabilities

Apple released iOS 27 and iPadOS 27 patching roughly 126 vulnerabilities across kernel, WebKit, sandboxing, and authentication components; no active exploitation reported.

Apple released iOS 27 and iPadOS 27 on September 14, 2026, fixing approximately 126 vulnerabilities across more than 90 components, including the kernel, WebKit, AppleKeyStore, Sandbox, and TCC. Flaws include memory corruption, information disclosure, denial-of-service, logic errors, sandbox escapes enabling root privileges, and a Bluetooth issue permitting remote code execution in specific circumstances. Apple also shipped iOS 26.7 and iPadOS 26.7 with over 80 fixes for users delaying the major upgrade, including 75 vulnerabilities shared with iOS 27. No vulnerabilities were reported as actively exploited at release time.

GBHackers · 6h agoAdvisory

SAP security advisory – September 2026 monthly rollup (AV26-894)

Canada's Cyber Centre relayed SAP's September 2026 Patch Day rollup covering vulnerabilities across NetWeaver, kernel components, CAP, and Integration Suite.

The Canadian Centre for Cyber Security published advisory AV26-894 noting that as of September 8, 2026, SAP is affected by vulnerabilities in multiple products, including SAP Extended Passport, NetWeaver Message Server, SAP Cloud Application Programming Model, SAP GUI for Java, Integration Suite Cloud Integration, NetWeaver Business Client, and NetWeaver AS for ABAP. The advisory corresponds to SAP Security Patch Day September 2026 and lists many affected kernel and web dispatcher versions. Administrators are urged to review the SAP advisory and apply updates as available.

Canadian Centre for Cyber Security · 7d agoAdvisory

Chipmaker Patch Tuesday: Nvidia, AMD, Arm Issue Security Advisories

AMD, Arm, and Nvidia issued Patch Tuesday advisories fixing a Linux GPU driver DoS flaw, nine Mali GPU vulnerabilities, and two high-severity Triton defects.

AMD fixed CVE-2026-43603, a NULL pointer dereference in its Linux GPU kernel driver that can crash systems and cause denial-of-service, credited to SecMate researchers, with patches for EPYC, Ryzen, Radeon, and Instinct shipped in July and embedded variants due in October. Arm published an advisory covering nine Mali GPU vulnerabilities allowing use-after-free access, kernel information leaks, or DoS, releasing fixes for Valhall and 5th Gen GPU Architecture drivers, with Bifrost also affected. Nvidia updated Triton Inference Server for Linux to resolve two high-severity flaws, one causing DoS and one enabling information disclosure, data tampering, and DoS. Intel had issued no new advisories since the previous Patch Tuesday.

SecurityWeek · 6d agoAdvisoryCVE-2026-43603

Microsoft September 2026 Patch Tuesday Fixes 973 Vulnerabilities and 2 Exploited Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including two zero-days already exploited in the wild.

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, and Azure components, including two zero-days already exploited in the wild. CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, is flagged as an exploited zero-day. The release includes numerous remote code execution and information disclosure fixes for Microsoft Excel and Word, plus patches for the Windows kernel, ALPC, Print Spooler, ReFS, Entra ID, and Azure CLI.

GBHackers · 7d agoAdvisory in the wildCVE-2026-85880CVE-2026-85877CVE-2026-85875+27 CVEs

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer · 7d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1

Windows memory integrity switches on automatically for eligible devices in October 2026

Microsoft's Windows quality updates will automatically enable memory integrity and Virtualization-based Security on eligible devices starting October 2026.

Beginning in October 2026, Windows quality updates will automatically enable memory integrity on eligible devices and turn on Virtualization-based Security where it is not already running. Memory integrity restricts kernel-mode execution to trusted, signed code and drivers, blocking kernel compromise and rootkits. Microsoft said existing administrator decisions remain in effect, and readiness checks weigh hardware capability, compatibility, and performance. Memory integrity also underpins hotpatch updates that install without a reboot, so unprotected devices are excluded from that servicing model.

Help Net Security · 13d agoAdvisory

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities, including 113 critical, with two Windows privilege-escalation bugs (CVE-2026-81963, CVE-2026-85880) exploited in the wild.

Microsoft's September 2026 security update addresses 973 vulnerabilities across its product lineup, 113 rated critical, of which 82 are remote code execution flaws. Two vulnerabilities are confirmed exploited in the wild: CVE-2026-81963, an elevation-of-privilege flaw in the Windows Update Stack (CVSS 7.8), and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (CVSS 7.8). Microsoft flags several bugs as more likely to be exploited, including a 9.8 RCE in Windows DNS Server (CVE-2026-69730), an 8.8 RCE in Windows Kerberos (CVE-2026-69676), and a 9.0 EoP in Spring Cloud Azure (CVE-2026-69854). Cisco Talos published accompanying Snort rules to detect exploitation attempts against the prominent flaws.

Cisco Talos · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69676+27 CVEs

Oracle Patches 800+ Vulnerabilities in September 2026 Security Update

Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.

Oracle released 673 new security patches in its September 2026 Critical Security Patch Update, resolving 672 unique CVEs across 17 risk matrices plus 130+ additional CVEs. More than 100 flaws are critical severity and over 240 are remotely exploitable without authentication. Oracle E-Business Suite received the largest batch with 159 patches, followed by Fusion Middleware (153, including 78 unauthenticated remote flaws) and Hyperion (102). Oracle reports no exploitation of these specific flaws but warns attackers routinely exploit unpatched Oracle products.

SecurityWeek · 3h agoAdvisory

Android’s September 2026 Updates Patch 180 Vulnerabilities

Google's September 2026 Android security updates patch 180 vulnerabilities including critical Wi-Fi memory corruption flaw CVE-2026-28662.

Google released September 2026 Android security updates addressing 180 vulnerabilities across two patch levels. The 2026-09-01 level fixes 95 bugs including 23 critical System component flaws enabling RCE, EoP, and DoS. The 2026-09-05 level addresses 85 additional defects in kernel and vendor components including a Wi-Fi memory corruption flaw (CVE-2026-28662) enabling remote code execution without privileges or user interaction.

SecurityWeek · 6d agoAdvisoryCVE-2026-28662

September 2026 Patch Tuesday: Record patch count, 2 zero-days, and a SigRed successor

Microsoft's September 2026 Patch Tuesday delivers a record patch count, fixing two exploited zero-days and a wormable DNS flaw dubbed a SigRed successor.

Microsoft's September 2026 Patch Tuesday sets another record patch count, fixing two vulnerabilities exploited as zero-days: CVE-2026-81963, a Windows Update Stack low-privilege-to-SYSTEM escalation reported by MSTIC, and CVE-2026-85880, a Windows Advanced Local Procedure Call escalation reported by Proofpoint. Zero Day Initiative's Dustin Childs urges priority on a cluster of 20 potentially wormable bugs including DNS RCE CVE-2026-69730, described as a spiritual successor to SigRed, plus Kerberos authentication bypass CVE-2026-69676 that could give any authenticated domain user RCE on domain controllers, and Exchange RCE CVE-2026-55007 via a malicious Visio attachment. All Windows fixes are bundled in cumulative updates, and experts stress prioritizing exploitable, reachable flaws over raw patch counts.

Help Net Security · 7d agoAdvisory in the wildCVE-2026-81963CVE-2026-85880CVE-2026-69730+4 CVEs

Microsoft Patch Tuesday for August 2026 Fixed a Zero

Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, .NET and other products, with 62 rated Critical. The actively exploited CVE-2026-68820 is a use-after-free in the Windows WinSock afd.sys driver that can yield SYSTEM privileges via a race condition. CVE-2026-62878 is a critical, wormable stack buffer overflow in Windows DNS Server allowing unauthenticated, remote code execution without user interaction. Other notable fixes include WDS TFTP RCE CVE-2026-62893, a QUIC flaw affecting roughly 13.5 million sites (CVE-2026-62815), an Exchange authentication bypass EoP demonstrated at Pwn2Own Berlin (CVE-2026-62911), and two TPM 2.0 reference implementation fixes.

Security Affairs · Aug 12, 2026Advisory in the wildCVE-2026-68820CVE-2026-62878CVE-2026-62893+5 CVEs