🧰 Linux kernel

The items that name it 69

• ClioBitcoinBank 🏴‍☠️ (@ClioBitcoinBank) on X
  advisoryas affected products2026-10-31

  IPv4 TCP

• Critical Linux kernel flaw allows remote root attacks on MPTCP servers
  articleas affected products2026-10-30

  versions dating back to 4.4

• PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
  articleas affected products2026-10-30

  Fragnesia privilege escalation bug

• CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
  articleas affected products2026-10-30

  IPv4 TCP handshake path; fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and the 7.3 development line

• Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)
  advisoryas classification.technologies2026-10-29
• CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
  articleas affected products2026-10-29It is written here as Linux kernel: XFRM ESP-in-TCP subsystem, major Linux distributions with kernels released before May 13, 2026.

  XFRM ESP-in-TCP subsystem, major Linux distributions with kernels released before May 13, 2026

• CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions
  advisoryas affected products2026-10-29It is written here as Linux kernel (IPv4 TCP stack; Ubuntu page title states all Ubuntu versions are affected).

  IPv4 TCP stack; Ubuntu page title states all Ubuntu versions are affected

• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  advisoryas affected products2026-10-28It is written here as Linux Kernel (CVE-2026-46300, Missing Initialization of a Variable Vulnerability).

  CVE-2026-46300, Missing Initialization of a Variable Vulnerability

• China-Linked Hackers Exploit PHP2Shell to Root Firewalls
  articleas affected products2026-10-28It is written here as Linux kernel (Fragnesia privilege escalation bug, CVE-2026-46300).

  Fragnesia privilege escalation bug, CVE-2026-46300

• Backporting security fixes to stable releases
  articleas classification.technologies2026-10-27
• AI Quanting (@AIQuanting) on X
  threadas classification.technologies2026-10-24
• Bringing post-quantum cryptography to geographically fenced key management
  articleas classification.technologies2026-10-23
• LLMs are making formal software verification feasible at a much larger scale
  articleas classification.technologies2026-10-22
• Several Linux kernel vulnerabilities accidentally posted to public mailing list
  articleas classification.technologies2026-10-22
• How Effectively Do Security Skills Guide Coding Agents in Vulnerability Detection in Linux Kernel?
  paperas affected products2026-10-19It is written here as Linux kernel (100 real vulnerabilities across ten classes used as the benchmark, plus 100 previously unseen vulnerabilities for evaluation).

  100 real vulnerabilities across ten classes used as the benchmark, plus 100 previously unseen vulnerabilities for evaluation

• lee1981 (@lee1981b) on X
  articleas classification.technologies2026-10-18
• Dark Web Intelligence (@DailyDarkWeb) on X
  advisoryas affected products2026-10-17It is written here as Linux kernel (timer, signal, memory, futex, scheduler and SLUB code).

  timer, signal, memory, futex, scheduler and SLUB code

• lee1981 (@lee1981b) on X
  advisoryas classification.technologies2026-10-17
• Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
  advisoryas affected products2026-10-13
• ZDI: The October 2026 Security Update Review
  advisoryas affected products2026-10-13
• No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt
  paperas affected products2026-10-10
• 3 lessons from frontier AI vulnerability research
  writeupas affected products2026-10-07It is written here as Linux kernel (vulnerability research and reports, including first Akrites-coordinated patch merge).

  vulnerability research and reports, including first Akrites-coordinated patch merge

• Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies
  articleas affected products2026-10-07

  OpenAI agents exploited a known Linux kernel flaw to escalate privileges on OpenAI's own systems, in a separate incident.

• Several vulnerabilities have been discovered in the Linux kernel
  advisoryas affected products2026-10-01It is written here as Linux kernel (linux).

  Debian package 'linux', affected versions prior to fix; fixed version 6.12.111-1 for the stable distribution (trixie)

• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
  articleas affected products2026-09-30

  Network driver advisories contributed to High-Risk vulnerability spikes in mid-2026; also noted that 'Linux Kernel' description CVEs generated ~5,000 CVEs Jan-Aug 2026 with zero observed exploited zero-days.

• No Time to Pwn: CVE-2026-72018 Linux Kernel LPE | XBOW
  writeupas affected products2026-09-28

  SMC-D historically ran only on IBM Z mainframe ISM hardware; the dibs_loopback driver made it runnable over loopback on stock x86 Linux, exposing previously unreachable code paths (net/smc/af_smc.c, net/smc/smc_tx.c, net/smc/smc_ism.h, drivers/dibs/dibs_loopback.c, net/smc/smc_clc.h, net/smc/smc_cdc

• Containers Are No Longer a Security Boundary (CVE-2026-80521)
  writeupas affected products2026-09-22

  AF_UNIX subsystem garbage collection mechanism; nearly 6000 kernel CVEs published as of September 2026 (5,976 unique Linux kernel CVEs published as of mid-September 2026)

• Markakd/Container_escape
  repoas affected products2026-09-16

  Target kernel for CVE-2026-52910 PoC

• Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root
  writeupas affected products2026-09-04

  Vulnerable pattern present in networking code (ESP and RxRPC paths) for years; reaches back across most supported kernel versions and nearly every major distribution; vulnerable pattern goes back to kernels from around 2017

• VMs won't contain cyber-capable agents
  writeupas affected products2026-08-26It is written here as Linux kernel (host).

  Debian 12 host kernel on AMD Zen3; vulnerable to Januscape (CVE-2026-53359) and other disclosed/undisclosed bugs; also run with mitigations=off.

• Why C Has Always Broken Static Analysis | Blog | Endor Labs
  articleas affected products2026-08-25

  Memory-safety bugs made up 65 to 70 percent of high and critical vulnerabilities, year after year

• Rumour Is the Exploit — AI agents collapse time-to-exploit to near-zero
  articleas affected products2026-08-22

  Ships fixes as soon as possible, deferring at most seven days and exceptionally fourteen.

• UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
  writeupas affected products2026-08-20

  Affected by CVE-2022-0995 (watch_queue), CVE-2010-3904 (RDS protocol), CVE-2022-0847 (Dirty Pipe)

• armourinfosec/Offensive-Linux-Privilege-Escalation
  repoas classification.technologies2026-08-19
• ITScape / Januscape / Zapscape
  repoas affected products2026-08-15

  v7.1-rc6 used for PoC build, version right before the vulnerability was patched

• sgkdev/bad_garbage
  repoas affected products2026-08-10

  AF_UNIX socket garbage collector; 7.x kernels and the Ubuntu 6.8 GA kernel are also vulnerable but out of scope for this exploit

• Talaria
  repoas classification.technologies2026-07-31
• Rapid7
  articleas affected products2026-07-30

  Required for Fetch Fileless payloads using memfd_create syscall

• Atlasのご紹介：WizのAI脆弱性リサーチャー
  articleas affected products2026-07-27

  open-source project scanned by Atlas; previously unknown vulnerabilities found

• LSPosed/LSPromise
  repoas classification.technologies2026-07-23
• Samsung Kernel UAF (CVE-2026-20971)
  writeupas classification.technologies2026-07-18
• Kubernetes Runtime Security : The Guide
  articleas classification.technologies2026-06-07
• cicd-sensor: eBPF Runtime Security for CI/CD Pipelines
  repoas affected products2026-06-04

  5.15 or later on amd64, 6.1 or later on arm64, required to run the eBPF sensor

• PathSentinel Radar
  toolas affected products2026-05-16It is written here as Linux kernel (varias distribuciones, vulnerabilidad Fragnesia).

  varias distribuciones, vulnerabilidad Fragnesia

• Panic at the Distro
  writeupas affected products2026-05-14

  algif_aead crypto API vulnerability (CopyFail) introduced in kernel 4.14 in 2017; affects most popular Linux distributions since the flaws reside in core kernel components

• Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP | Wiz Blog
  advisoryas affected products2026-05-13It is written here as Linux kernel (original Dirty Frag vulnerabilities; Fragnesia emerged as an unintended side effect of one of the patches addressing them).

  original Dirty Frag vulnerabilities; Fragnesia emerged as an unintended side effect of one of the patches addressing them

• CSA: VulnOps in the Age of AI
  articleas affected products2026-05-13
• 0xor0ne Awesome List
  repoas affected products2026-05-12
• Dirty Frag (CVE-2026-43284) Linux Privilege Escalation | Wiz Blog
  advisoryas affected products2026-05-08

  affected code path dates back to approximately 2017

• How to Secure a Linux Server
  repoas classification.technologies2026-05-06
• Copy Fail (CVE-2026-31431): Universal Linux Local Privilege Escalation Vulnerability
  advisoryas affected products2026-05-01
• Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability | Ubuntu
  advisoryas affected products2026-04-30
• Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE via AF_ALG/splice()
  writeupas affected products2026-04-29

  AF_ALG/algif_aead in-place decryption path combined with authencesn scratch write

• Missing system calls in the Linux kernel audit subsystem classes (CVE-2025-71239, CVE-2026-23241)
  writeupas affected products2026-03-08

  audit subsystem classes missing fchmodat2(), getxattrat(), listxattrat() system calls, allowing bypass of auditd filesystem watch rules

• Deobfuscating Files for Flags: Huntress CTF 2025 Retro
  articleas affected products2025-11-06
• Today I learned: binfmt_misc
  writeupas affected products2025-10-30

  allows kernel to recognize and execute custom binary formats, exploitable for persistence

• Linux Capabilities Revisited
  writeupas classification.technologies2025-05-16
• Today I Learned - Protected Symlinks
  writeupas affected products2025-02-24

  protected_symlinks sysctl protection (/proc/sys/fs/protected_symlinks); does not protect against symlinks placed in subdirectories that do not inherit the sticky bit from their parent (e.g. /tmp)

• Reptile's Custom Kernel-Module Launcher
  writeupas affected products2024-11-10

  Targeted via kernel module loading (init_module/finit_module syscalls) to insert the Reptile rootkit module.

• Tainted Kernels
  writeupas affected products2024-07-12

  kernel version 5.4.0-122-generic, subject to tainting via out-of-tree/unsigned module loading

• Today I Learned - kernel.modules_disabled
  writeupas affected products2024-07-10

  kernel.modules_disabled sysctl parameter is off by default (kernel.modules_disabled = 0), allowing loading/unloading of kernel modules

• The 'Invisibility Cloak' - Slash-Proc Magic
  writeupas classification.technologies2024-05-16
• On checking set*id() return values
  writeupas affected products2023-07-26

  RLIMIT_NPROC check on setuid() introduced in 2.6, causing EAGAIN failures; fixed in 3.1

• Security in the LLM Age - Greg Kroah-Hartman
  videoas affected productsIt is written here as Linux kernel (releases through 7.2).

  releases through 7.2

• Claude Desktop (macOS): malicious file in a Cowork folder could run commands on the host
  advisoryas classification.technologies
• Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software
  paperas affected products

  Subject of 834 manually curated vulnerability samples spanning 74 CWEs used in the CWE-Trace evaluation framework

• Three CVEs and the May 2026 Exploit Chain Nobody's Taking Seriously (nginx Rift)
  articleas classification.technologies
• Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code
  repoas affected products

  9-year-old vulnerability

• Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by AI-assisted fuzzing
  advisoryas affected products

  Affects essentially every mainstream Linux distribution shipped since 2017; AF_ALG (kernel crypto API) ships enabled by default in essentially every mainstream distro's default config

In every workspace you can read 70