Do Son A critical Linux kernel CVE-2026-98432 flaw enables remote root execution via MPTCP race conditions, impacting multiple distributions including Ubuntu.
Linux Kernel
CISA adds Linux kernel vulnerability CVE-2026-46300, chained with PHP2Shell for root, and VMware ESX flaw CVE-2026-41709 to KEV. Patch now.
Anthropic's AI vulnerability research found remote code execution chains in Chrome, Safari, Android, Windows and Linux. All are now fixed.
PoC and full details are public for the Linux nf_tables vulnerability CVE-2026-23111. The kernelCTF exploit gains root and escapes containers. Patch now.
A PoC and full details are public for CVE-2026-43501 (CVSS 9.8), a Linux kernel IPv6 vulnerability in RPL source routing. Update your kernel now.
ZDI publicly posted details of unpatched Linux kernel vulnerabilities, including two CVSS 9.0 KSMBD remote code execution flaws. Fixes are pending.
The Linux Assisted-by tag is going away after maintainers agreed it misreports AI use, but human accountability stays.
PwnEscape (CVE-2026-99999) is a critical Linux kernel VM escape that let a guest run code as root on the host in lab tests. Update your kernel now.
Details and PoC exploits are public for six Linux kernel vulnerabilities, including CVE-2026-98260, enabling privilege escalation. Patch now.
Linus Torvalds used a Claude Code Linux kernel patch to triple small data read speeds via RCU memory management, though the experimental code needs testing.
Technical details and PoC exploit code for CVE-2026-74580 (Vghost), an 8.8-severity Linux vhost vulnerability allowing root LPE and VM escape, are out.
VUSec released details and PoC code for Branch Target Reuse, a Spectre-v2 attack on JIT engines that leaked Linux root password hashes. Patch now.
Details for a critical Linux container escape flaw are public. Discover how this Linux container escape flaw works and review key mitigation steps.
Learn why Canonical accelerated Ubuntu kernel updates. A surge in CVEs prompted a shift to an overlapping two-week SRU cycle for faster vulnerability patching.
RustyTux is a public PoC for a Linux kernel privilege escalation via an ESP-in-TCP use-after-free (CVE-2026-23239). Details and exploit code are now public.
This weekly CVE report tracks 4,378 new flaws and 10 exploited vulnerabilities, checked against the live CISA KEV catalog. See which bugs to patch first.
CISA warned of exploited Linux kernel vulnerabilities in the KEV catalog. Patch these Linux kernel vulnerabilities to block privilege escalation.
Four Linux kernel privilege escalation flaws were disclosed with public PoC exploits granting local root. Details and patches are now out. Update now.
A critical KVM guest escape (CVE-2026-89775) enables an LPE to gain root on Linux hosts. Patch this KVM guest escape vulnerability now.
Debian 13.7 is out as the seventh point release, bundling 106 bug fixes and 107 security updates with kernel 6.12.107+deb13. Upgrade now.
Asahi Linux M3 support reaches the mainline kernel with Wi-Fi and storage working, but GPU, Thunderbolt, and display remain in development.
The details and PoC exploit code for the ZcopyReaper Linux vulnerability (CVE-2026-43502) are publicly disclosed, posing a privilege escalation risk.