Search: “PowerScale OneFS”

30 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

SeverityAll critical 1 high 0 medium 2 low 0 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

ZDI-26-653: TrendAI Apex One Security Agent Cache Mechanism Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

ZDI-26-653: TOCTOU race in Trend Micro Apex One cache mechanism, CVE-2025-71415, enables local privilege escalation, rated CVSS 7.8.

The Zero Day Initiative published advisory ZDI-26-653 for the Trend Micro Apex One Security Agent. A time-of-check time-of-use (TOCTOU) flaw in the cache mechanism, tracked as CVE-2025-71415, allows local attackers to escalate privileges after gaining low-privileged code execution. ZDI assigned a CVSS 7.8 rating. A vendor patch is available for affected installations.

ZDI Published AdvisoriesSep 10, 05:00 UTC · 6d agoAdvisory 3 sources CVE-2025-71415

ZDI-26-697: Linux Kernel NTFS3 Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI-26-697: Linux Kernel NTFS3 out-of-bounds read rated CVSS 7.3 lets local low-privileged attackers disclose sensitive information.

ZDI advisory ZDI-26-697 describes an out-of-bounds read in the Linux Kernel NTFS3 driver rated CVSS 7.3. An attacker must first be able to execute low-privileged code on the target system to exploit the flaw. Successful exploitation leads to sensitive information disclosure. No CVE identifier is listed in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability 3 sources

Dell security advisory (AV26-886)

Canada's Cyber Centre flags September 2026 Dell vulnerabilities across iDRAC9/iDRAC10, OpenManage, PowerEdge, Avamar, NetWorker VE, PowerProtect, IDPA and PowerScale OneFS.

Canadian Centre for Cyber Security advisory AV26-886 lists Dell vulnerabilities across iDRAC9, iDRAC10, OpenManage Network Integration, PowerEdge servers, the OpenManage Python SDK, Avamar, NetWorker Virtual Edition, PowerProtect DP Series, IDPA and PowerScale OneFS. Fixed versions include iDRAC9 7.30.10.50, iDRAC10 1.30.30.50 and OpenManage Network Integration 3.10. No CVE identifiers or exploitation status are provided; administrators are urged to apply the vendor updates.

Canadian Centre for Cyber SecuritySep 8, 14:07 UTC · 7d agoAdvisory

Survey of filesystem MCP servers: how the "sandboxed filesystem" boundary is enforced (one breach, four defended-by-design)

Survey finds one filesystem MCP server vulnerable to a symlink-based sandbox escape while four others are defended by design.

A survey of five filesystem MCP servers assessed how each enforces its path-confinement boundary against symlink escapes in recursive directory walkers. The iceener/files-stdio-mcp-server is vulnerable to a read-side sandbox escape. The other four are defended by design or make no confinement claim. The author describes the vulnerability class as small but real.

oss-securitySep 10, 01:14 UTC · 6d agoVulnerability

Dell security advisory (AV26-843)

Canada's Cyber Centre issued advisory AV26-843 covering Dell vulnerabilities requiring updates across Alienware, PowerScale, PowerStore, and other products.

The Canadian Centre for Cyber Security published advisory AV26-843 on August 24, 2026, noting Dell products affected by vulnerabilities as of August 17, 2026. Affected products include Alienware Command Center prior to 6.14.20.0, Dell Command Update prior to 5.7.1, Dell Networking OS10 prior to 10.5.6.14, PowerScale OneFS prior to 14.1, PowerStore OS prior to 5.0.0.2, OpenManage Enterprise prior to 4.7.0, ObjectScale prior to 4.3.0.1, Metro Node prior to 4.6.0.4, and others. Users are directed to apply the vendor's updates.

Canadian Centre for Cyber SecurityAug 24, 13:12 UTC · 22d agoAdvisory

🔬“We have foundation models for language, not for physics” — Anima Anandkumar, Bren Professor of Computing

Caltech professor Anima Anandkumar discusses Neural Operators and FourCastNet for physics modeling, arguing inductive biases beat pure token scaling.

Anima Anandkumar, Bren Professor at Caltech and co-founder of Accelerated Understanding, describes Fourier Neural Operators that learn in frequency and spherical-harmonic domains to model weather, fusion, and fluid or heat flow. Her team built FourCastNet 3, a global weather model competitive with physics-based simulations that runs on consumer-grade GPUs. She also introduced TorchLean, a framework for writing PyTorch-style networks inside the Lean proof assistant for formal verification, and was appointed to the United Nations Scientific Advisory Board. She argues physical domains resist scaling due to tiny datasets and context lengths in the hundreds of billions, so progress comes from built-in structure and physical priors.

Latent SpaceAug 26, 15:15 UTC · 20d agoAI research1

AI Infra Summit: NVIDIA Vera Rubin and DSX Platform Advancements Showcase Energy Efficiencies of Optimizing Tokens Per Watt for AI Factories

At AI Infra Summit, NVIDIA showcased Vera Rubin and DSX gains up to 1.4x tokens per megawatt, plus Annapurna, d-Matrix, and Pinterest partnerships.

Ian Buck's AI Infra Summit keynote before 8,000+ attendees emphasized validated agentic tokens per megawatt as the emerging AI infrastructure metric. Announcements include Amazon's Annapurna Labs collaborating on NVHBM custom high-bandwidth memory, d-Matrix integrating NVLink Fusion with Raptor XPUs, and Pinterest using Blackwell plus Dynamo inference software for conversational visual discovery. Lambda reported 23% better performance per watt with DSX MaxLPS on Blackwell servers, running 19 nodes on a 16-node power budget. NVIDIA says DSX MaxLPS combined with Groq 3 LPX on Vera Rubin NVL72 targets up to 35X token throughput per megawatt versus GB200 NVL72 for 2-trillion-plus-parameter models.

NVIDIA BlogSep 15, 16:55 UTC · 14h agoAI industry

Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system

Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.

Dell advisory DSA-2026-393 (September 10, 2026) covers multiple flaws in ObjectScale and Elastic Cloud Storage (ECS). CVE-2026-70416 is a critical untrusted-data deserialization RCE (CVSS 10.0) in ObjectScale before 4.4.0.0 allowing unauthenticated remote code execution and full environment takeover, credited to researcher WinD39 (Huynh Dinh Vu). Additional issues include CVE-2025-43936 improper authentication (8.1), CVE-2026-26947 privilege management (6.7), CVE-2026-36591-style weak crypto CVE-2025-36591 (4.4), CVE-2026-76104 permission assignment DoS (5.5), plus third-party CVEs in Apache Log4j, liblzma, and the Linux kernel. Dell advises upgrading to version 4.4.0.0 or later (or 4.2.0.1) and restricting management interfaces until patched.

Cyber Security NewsSep 13, 14:43 UTC · 2d agoVulnerability CVE-2026-70416 CVE-2025-43936 CVE-2026-26947+8 CVEs2

Retrospectively Reverse-Engineering Apple's Neural Engine

A developer reverse-engineers Apple's M1 Neural Engine architecture, mapping compute cores, MAC datapaths, and schedulers to explain the NPU's decline as transformers displaced CNN workloads.

A developer who previously maintained a reverse-engineered Linux driver for Apple's Neural Engine (ANE) published a retrospective deep dive mapping the M1 ANE's full internal architecture: compute, datapath, scheduler, memory, and execution model. The M1 ANE has 16 compute cores with 128 FP16 (or 256 INT8) MAC lanes each, totaling 2048 parallel MAC lanes, using 32-bit Q16.16 fixed-point accumulation with FP16 readout and an accumulator that saturates at 2^15. The author argues the ANE's dataflow was architected around the predictable reuse patterns of 2017-era CNN workloads (dating to the A11 Bionic), which autoregressive transformer decode broke, limiting its usefulness for general ML. With Apple's M5 folding ANE cores into GPU cores to tout LLM performance, the post frames this as the beginning of the end for the standalone NPU.

Hacker News · AISep 12, 07:54 UTC · 3d agoAI research HN 54↑ · 7 comments2

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CRSep 4, 11:23 UTC · 11d agoResearch

OPEN-1B: A Fully Auditable Training Run

Open-1B releases a 1B-parameter model with bitwise-reproducible training, letting independent auditors verify every step of the run on commodity hardware.

The paper introduces a 'fully auditable' tier of model transparency: every training operation is reproducible with bitwise certainty on heterogeneous commodity hardware by imposing definite ordering on GPU kernel reductions, data batch ordering, and collective communication. Because replaying a full run on one machine is infeasible, a collective verification scheme lets many independent auditors certify individual steps covering the whole run. The authors release Open-1B with its full pretraining dataset, every intermediate checkpoint, the training codebase, and an audit harness. This rules out undisclosed data, injected biases, or backdoors that proof-of-learning or proof-of-training-data techniques cannot exclude.

arXiv cs.AI / cs.LG / cs.CLSep 15, 16:23 UTC · 15h agoAI research

CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives

CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.

CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.

arXiv cs.CRSep 9, 15:44 UTC · 6d agoResearch1

ZDI-26-569: Linux Kernel Net Scheduler True Link Equalizer Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-569, a CVSS 7.5 race condition local privilege escalation in the Linux kernel net scheduler true link equalizer.

The Zero Day Initiative disclosed a race condition in the Linux kernel's net scheduler true link equalizer component enabling local privilege escalation. Exploitation requires the attacker to first run high-privileged code on the target system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published AdvisoriesAug 13, 05:00 UTC · Aug 13, 2026Advisory

Building a Linux GPU Driver for the M4 Mac Mini in One Month

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AISep 15, 19:30 UTC · 12h agoResearch HN 40↑ · 5 comments

12 Best Browser Isolation Solutions Compared (2026): Features & Pricing

2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.

Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.

GBHackersSep 15, 06:27 UTC · 1d agoTools

Corero brings cloud-based AI threat analysis to SmartWall ONE

Corero adds cloud-delivered AI analysis to SmartWall ONE for faster DDoS attack identification and automated protection policy generation.

Corero Network Security announced AI-Augmented Cloud-Assist for SmartWall ONE, a cloud-delivered AI layer that analyzes DDoS telemetry, identifies emerging attack behaviors, and recommends protection policies that can be applied manually or automatically within seconds. It creates a continuous intelligence loop between Corero's cloud and on-premises SmartWall ONE deployments, with security experts providing oversight. The feature targets AI data centers, NeoCloud providers, service providers, and digital enterprises requiring low-latency edge mitigation.

Help Net SecurityAug 20, 00:00 UTC · 27d agoTools

US Finance Under Phishing Pressure: What the SOC Data Reveals?

ANY.RUN SOC telemetry shows escalating phishing campaigns against US finance, including Vercel-hosted RMM attacks abusing legitimate services.

ANY.RUN analyzed SOC telemetry data on phishing targeting the US financial sector, concluding that the scale and security impact should not be understated. The analysis highlights modern campaigns such as Vercel-hosted attacks that deliver remote monitoring and management (RMM) tools. It notes that attackers increasingly abuse legitimate services and everyday workflow tools to deliver phishing, making detection harder for SOC teams.

ANY.RUNAug 26, 09:17 UTC · 20d agoPhishing & fraud in the wild

Linux Detection Engineering - Fileless Execution

Elastic Security Labs reproduces five Linux fileless execution patterns, including memfd_create staging and in-memory kernel module loads, and maps each to Elastic Defend rules.

Elastic Security Labs reproduced five Linux fileless execution patterns using its FENIX tooling: memfd_create staging, interpreter one-liners, deleted binaries, and in-memory kernel module loads. Each pattern is mapped to the Elastic Defend detection rules that catch it. The post is part of the team's ongoing Linux detection engineering series.

Elastic Security LabsSep 1, 14:26 UTC · 14d agoResearch

Intelligence-Driven SOC: Modernizing Threat Monitoring and Detection Engineering for Ultimate MTTR Reduction

ANY.RUN urges SOC teams and MSSPs to adopt intelligence-driven threat monitoring to reduce mean time to respond.

ANY.RUN published a vendor blog post arguing that threat monitoring is the connective tissue of modern security operations and that SOC teams and MSSPs must move from simple log collection to a proactive, intelligence-driven framework. The piece promotes ANY.RUN's Threat Intelligence offering as the solution for detection engineering and MTTR reduction. It is promotional content rather than a threat disclosure or research finding.

ANY.RUNAug 12, 07:58 UTC · Aug 12, 2026Industry

From Megawatts to Tokens: How NVIDIA Maximizes AI Factory Production

NVIDIA detailed DSX power-management results: Lambda gained 24% token throughput at fixed power, and an AI factory auto-shed 1MW via Emerald AI's grid program.

NVIDIA says Lambda's first validation of DSX MaxLPS on HGX B200 servers ran 19 nodes within a 16-node power budget, lifting cluster token throughput 24% (roughly 4M to 5M tokens/second) and improving performance per watt by 23%. NVIDIA projects DSX MaxLPS can enable up to 40% more GPU capacity for Vera Rubin NVL72 factories within the same megawatt budget. Emerald AI's Conductor platform, running at NVIDIA's Eos factory with Silicon Valley Power, responded to over 200 utility demand signals, automatically dropping power from 4MW to 3MW without interrupting priority workloads. The first dedicated DSX Flex commercial deployment is planned at a 96-megawatt Manassas, Virginia facility.

NVIDIA BlogSep 15, 16:55 UTC · 14h agoAI industry

AI compute provider Nscale is looking for $3.5B in pre-IPO financing

British AI compute provider Nscale seeks $3.5B pre-IPO via $1.5B convertible notes and $2B from Nvidia ahead of a possible September IPO.

Nscale, a British AI infrastructure company founded about two years ago, is reportedly in talks to raise $3.5 billion ahead of an IPO that could come as early as late September 2026: $1.5 billion in convertible notes plus $2 billion in financing from Nvidia. Nvidia previously joined Nscale's $1.1 billion Series B in March, led by Aker and billed as the largest Series B in European history, following a $155 million Series A in December 2024. Nscale recently signed an approximately $45 billion deal with Anthropic and has told investors it has roughly $103 billion in projected revenue based on signed customer leases.

TechCrunch · AISep 4, 21:12 UTC · 11d agoAI industry

Chaotic Eclipse Released GreenSection, A PoC For NVIDIA Memory Corruption Zero-Day

Researcher Chaotic Eclipse released GreenSection, a PoC exploiting an unpatched out-of-bounds write in NVIDIA Windows user-mode shared memory.

Security researcher Chaotic Eclipse disclosed an out-of-bounds write in NVIDIA's Windows user-mode components, which share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with full read/write access to all users. The PoC crashes applications running Vulkan or OpenGL; the researcher says the bug could cross user boundaries or compromise dwm.exe but did not fully assess the impact. No CVE has been assigned and no patch is mentioned. The researcher recently released zero-day PoCs against Kaspersky, Avast, and CrowdStrike Falcon.

Security AffairsSep 7, 13:42 UTC · 8d agoExploit / PoC 2 sources

Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

oss-security thread discusses newly disclosed Linux kernel local privilege escalations, including ZcopyReaper (CVE-2026-43502) and about 20 more flaws.

An oss-security mailing list thread discusses newly disclosed Linux kernel local privilege escalation (LPE) issues, headlined by ZcopyReaper (CVE-2026-43502) along with roughly 20 more. Discussants ask whether the many reports could be summarized and note that locking kernel module loading after boot has repeatedly proven an effective mitigation. The visible discussion does not state whether any of the flaws are exploited in the wild or give specific patch guidance beyond the individual reports.

oss-securitySep 8, 17:02 UTC · 7d agoVulnerability CVE-2026-43502

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security LabsSep 11, 00:00 UTC · 5d agoResearch

Silver Rate Is (Almost) Optimal for Gradient Descent Acceleration

New optimization theory paper proves near-optimal lower bounds for gradient descent with predetermined stepsizes, confirming silver-schedule optimality.

The paper studies the limits of accelerating gradient descent using predetermined nonnegative stepsizes in smooth convex optimization, with the key constant p_sil = log2(1 + sqrt(2)). It proves a non-anytime lower bound of Omega(n^(-p_sil - O(sqrt(log log n / log n)))) on the error achievable by any such stepsize schedule. In the anytime setting, it shows every infinite nonnegative schedule must incur error Omega(n^(-2*p_sil/(1+p_sil) - O(sqrt(log log n / log n)))) at infinitely many horizons. Combined with the silver-schedule upper bound of Altschuler and Parrilo (2025) and the anytime upper bound of Zhang et al. (2025), these results determine the optimal polynomial convergence exponents in both settings.

arXiv cs.AI / cs.LG / cs.CLSep 8, 17:59 UTC · 7d agoAI research

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more

Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.

Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.

oss-securitySep 8, 03:53 UTC · 8d agoVulnerability CVE-2026-43502

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Responsenew

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN06:40 UTC · 1h agoTools

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-89688

VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot

CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.

CERT/CC's VU#718077, reported by Eclypsium researcher Stas Lyakhov, describes how a UEFI Shell embedded in SPI flash can be abused by attackers who can modify UEFI boot configuration, creating multiple boot entries that bypass controls preventing the Shell from launching under Secure Boot. The Shell's dmem and mm commands allow arbitrary physical memory read/write, letting attackers overwrite Secure Boot values and execute unauthorized pre-boot code that can persist across reboots and OS reinstalls while degrading EDR effectiveness. AMI confirmed its Aptio UEFI BDS module is affected (CVE-2026-33197), and Cisco published an advisory for a variation affecting UCS Servers and UCS-based appliances (CVE-2026-20293). Firmware patches are being rolled out through OEM and IBV BIOS build pipelines.

CERT/CC Vulnerability NotesSep 8, 15:05 UTC · 7d agoVulnerability CVE-2026-20293 CVE-2026-33197 CVE-2026-6485

ZDI-26-700: Linux Kernel QFQ Plus Scheduler Use-After-Free Local Privilege Escalation Vulnerability

ZDI discloses Linux Kernel QFQ Plus scheduler use-after-free (CVE-2026-22999, CVSS 7.8) enabling local privilege escalation on affected systems.

ZDI advisory ZDI-26-700 covers a use-after-free in the Linux Kernel QFQ Plus scheduler, tracked as CVE-2026-22999 with a CVSS score of 7.8. Exploitation requires the attacker to first execute low-privileged code on the target system. Successful exploitation allows local attackers to escalate privileges. No in-the-wild exploitation is mentioned.

ZDI Published AdvisoriesSep 14, 05:00 UTC · 2d agoVulnerability CVE-2026-22999