Linux Security News

Security news specific to Linux — kernel and distribution vulnerabilities, patches and exploitation affecting Linux systems.

Linux underpins most of the internet's servers, cloud infrastructure and embedded devices, making kernel and distribution-level vulnerabilities disproportionately consequential. This feed tracks CVEs, exploits and patches specific to the Linux kernel and major distributions as they are reported. It is the place to watch for the kind of privilege-escalation and remote-exploitation bugs that affect fleets rather than individual desktops.

Recent Linux items

CVE-2026-13198Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification functionali…
@cveNotify · Aug 14, 2026
CVE-2026-13197Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and process-imag…
@cveNotify · Aug 14, 2026
CVE-2026-13002A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single…
@cveNotify · Aug 14, 2026
CVE-2026-58224A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing in…
@cveNotify · Aug 14, 2026
CVE-2026-19879A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to…
@cveNotify · Aug 14, 2026
CVE-2026-53472A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javascript:` URL. Whe…
@cveNotify · Aug 14, 2026
JM00NJ/ICMP-Ghost-A-Fileless-x64-Assembly-C2-Agent: A fileless C2 framework written in pure x64 Linux Assembly with zero libc dependencies. Features dynamic protocol pivoting between raw ICMP sockets…
@malwr · Aug 14, 2026
CVE-2026-53472A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javascript:` URL. Whe…
@cveNotify · Aug 14, 2026
CVE-2026-19617A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled rec…
@cveNotify · Aug 14, 2026
CoolClient now uses a signed rootkit to hide at the Windows kernel level.The Mustang Panda-linked backdoor can hide its process, files, registry entries, and some C2 activity.Kaspersky found victims i…
@thehackernews · Aug 14, 2026
CVE-2026-13622A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /pr…
@cveNotify · Aug 14, 2026
CVE-2026-19617A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled rec…
@cveNotify · Aug 14, 2026
CVE-2026-13622A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /pr…
@cveNotify · Aug 14, 2026
CVE-2026-16730A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing t…
@cveNotify · Aug 14, 2026
CVE-2024-1139A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to d…
@cveNotify · Aug 14, 2026
CVE-2026-19617A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled re…
@cveNotify · Aug 14, 2026
CVE-2026-59692A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byt…
@cveNotify · Aug 14, 2026
CVE-2026-59691A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-en…
@cveNotify · Aug 14, 2026
CVE-2026-68454In the Linux kernel, the following vulnerability has been resolved:KVM: s390: pci: Fix handling of AIF enable without AISBWhen a guest seeks to register IRQs without a summary bit specif…
@cveNotify · Aug 13, 2026
CVE-2026-68453In the Linux kernel, the following vulnerability has been resolved:s390/zcrypt: Fix buffer over-read in cca_cipher2protkeyAdd validation of both the actual key buffer size and token leng…
@cveNotify · Aug 13, 2026
CVE-2026-68452In the Linux kernel, the following vulnerability has been resolved:s390/zcrypt: Validate length for CCA AES cipher key requestscca_cipher2protkey() derives the copy length for the CPRB p…
@cveNotify · Aug 13, 2026
CVE-2026-68451In the Linux kernel, the following vulnerability has been resolved:s390/zcrypt: Validate length for CCA ECC private key requestscca_ecc2protkey() derives the copy length for the CPRB par…
@cveNotify · Aug 13, 2026
CVE-2026-68447In the Linux kernel, the following vulnerability has been resolved:drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO sizeCRIU checkpoint copies the MQD control stack using cp…
@cveNotify · Aug 13, 2026
CVE-2026-68445In the Linux kernel, the following vulnerability has been resolved:drm/vc4: Prevent shader BO mappings from becoming writablevc4_gem_object_mmap() rejects a writable mapping of a validat…
@cveNotify · Aug 13, 2026
CVE-2026-68442In the Linux kernel, the following vulnerability has been resolved:btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent mapsWhen btrfs_drop_extent_map_range() splits an extent map,…
@cveNotify · Aug 13, 2026
CVE-2026-68440In the Linux kernel, the following vulnerability has been resolved:net: txgbe: fix heap overflow when reading module EEPROMtxgbe_read_eeprom_hostif() always copies round_up(length, 4) by…
@cveNotify · Aug 13, 2026
CVE-2026-68433In the Linux kernel, the following vulnerability has been resolved:libceph: bound get_version reply decode to front lenhandle_get_version_reply() uses msg->front_alloc_len as the decodeb…
@cveNotify · Aug 13, 2026
CVE-2026-68432In the Linux kernel, the following vulnerability has been resolved:vxlan: require CAP_NET_ADMIN in the device netns for changelinkA tunnel changelink() operates on at most two netns, dev…
@cveNotify · Aug 13, 2026
CVE-2026-68431In the Linux kernel, the following vulnerability has been resolved:ksmbd: validate minimum PDU size for transform requestsThe receive path applies the minimum SMB2 PDU size check only wh…
@cveNotify · Aug 13, 2026
CVE-2026-72693`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership t…
@cveNotify · Aug 13, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds — new CVE IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases tracked as they are reported.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches — what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.