Linux Security News

Security news specific to Linux: kernel and distribution vulnerabilities, patches and exploitation affecting Linux systems.

Linux underpins most of the internet's servers, cloud infrastructure and embedded devices, so kernel and distribution-level vulnerabilities matter more than their raw numbers suggest. CVEs, exploits and patches for the kernel and major distributions land here: the kind of privilege-escalation and remote-exploitation bugs that hit whole fleets, not just individual desktops.

Recent Linux items

CVE-2026-123806 python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, whic...
@cveNotify · Nov 12, 2026
CVE-2026-124006 XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a da...
@cveNotify · Nov 12, 2026
CVE-2026-86324 A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without en...
@cveNotify · Nov 12, 2026
CVE-2026-86323 A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/m...
@cveNotify · Nov 12, 2026
CVE-2026-86322 A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) witho...
@cveNotify · Nov 12, 2026
CVE-2026-126779 Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtm...
@cveNotify · Nov 12, 2026
CVE-2026-18379 A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vuln...
@cveNotify · Nov 12, 2026
CVE-2026-123040 An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user...
@cveNotify · Nov 12, 2026
CVE-2026-126623 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer 6.3.6 and 6.3.7 allows a remote attacker to hold the server's mail delivery threads or its REST A...
@cveNotify · Nov 12, 2026
CVE-2026-71363 A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL confi...
@cveNotify · Nov 12, 2026
CVE-2026-127101 A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL p...
@cveNotify · Nov 12, 2026
CVE-2026-127100 A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code...
@cveNotify · Nov 12, 2026
CVE-2026-127099 A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stac...
@cveNotify · Nov 12, 2026
CVE-2026-126831 A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving fi...
@cveNotify · Nov 12, 2026
ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories https://ift.tt/kNwdrUp
@ctinow · Nov 12, 2026
Microsoft researchers uncover growing GSocket backdoor activity on Linux servers https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/
@secharvester · Nov 12, 2026
Microsoft uncovers 59 Linux kernel bugs, including 8 with working root exploits. Also in this week's #ThreatsDay : • Falcon browser spyware • GSocket backdoor surge • Europol server takedown • $6.43B...
@thehackernews · Nov 12, 2026
CVE-2026-64478 In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies tha...
@cveNotify · Nov 12, 2026
CVE-2026-64458 In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: handle extreme intervals in damon_hot_score() Fix three issues in damon_hot_score() that comes f...
@cveNotify · Nov 12, 2026
CVE-2026-64457 In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/vir...
@cveNotify · Nov 12, 2026
CVE-2026-64455 In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskey_release() The chaoskey driver has a use-after-free bug in its rele...
@cveNotify · Nov 12, 2026
CVE-2026-64454 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: run gadget disconnect from sleepable suspend context dwc3_gadget_suspend() takes dwc->lock with IRQs disab...
@cveNotify · Nov 12, 2026
CVE-2026-63983 In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at th...
@cveNotify · Nov 12, 2026
CVE-2026-63982 In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop When mirred redirects to ingress (from either...
@cveNotify · Nov 12, 2026
CVE-2026-63981 In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow tcf_mirred_act() checks sched_mirred_...
@cveNotify · Nov 12, 2026
CVE-2026-82977 The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7 , 18.0.82 to 18.0.82.2 , allows cross-subscription information disclosure. 🎖
@cveNotify · Nov 12, 2026
CVE-2026-127030 A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated at...
@cveNotify · Nov 12, 2026
CVE-2026-127029 A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a c...
@cveNotify · Nov 12, 2026
CVE-2026-121876 A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gp...
@cveNotify · Nov 12, 2026
CVE-2025-10698 Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensiti...
@cveNotify · Nov 12, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.