Topic
Security research area covering vulnerabilities, exploits, and defenses in the Linux kernel and its networking subsystem.
Linux kernel flaw CVE-2026-99999 let pwn.ai's Paulos Yibelo read about 32 bytes of host memory per packet from Vercel's production sandboxes. Operators who host other people's VMs need the fix in the kernel the host itself runs.
Reality
Tencent Zhuque Lab published working demos on October 12 for Vghost (CVE-2026-74580), a vhost bug that gives local users root on Linux 4.11 through 7.2-rc4. The August 3 fix is out, but Ubuntu 24.04 and 26.04 kernels were still listed as in progress on October 13.
Reality
Researcher Asim Manizada published working local-root exploits for four Linux kernel bugs on 18 September 2026. On hosts where containers or exposed services share one kernel, any compromised service can now become a lost node.
Reality
Intel, AMD and Arm say their IBPB barrier can block Branch Target Reuse, a Spectre v2 variant hitting all three, if JIT software calls it. Each kernel, browser and runtime that rewrites JIT code now has to add that call itself.
Perspective Coverage
3 publishersReality
Copy Fail, tracked as CVE-2026-31431, lets any unprivileged local user write a chosen four bytes into the page cache of any readable file. Because it fires every time the right syscalls run in order, timing-based mitigations do not apply.
Reality
CISA added Linux kernel flaw CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on 18 September 2026. Affected versions and fixed builds come from each distribution's security notice, and a host is protected only once it reboots into the fixed kernel.
Reality
Canonical is merging two update cycles so that an Ubuntu kernel ships every week. Getting a CVE fix faster than that means running release candidates its certification testing has not yet cleared.
Reality
A dev.to write-up argues that Landlock's unprivileged self-confinement retires the profile-maintenance tax that AppArmor and SELinux impose, though the rules it describes are still paths, so somebody has to enumerate them.
Reality
The three kernel CVEs CISA added to its exploited-bugs catalog on Friday all need local access, and the lowest-scored of them is the one STAR Labs used for privilege escalation and container escape. Red Hat has confirmed public exploit code.
Perspective Coverage
6 publishersReality
A researcher posting to oss-security reports that all four proof-of-concept exploits gave an unprivileged local user root code execution on the test targets, against kernel code that has been in the tree for between 10 and 21 years.
Reality
Fixes are in for four Linux local-root bugs found in code more than a decade old. Turning off unprivileged user namespaces closes three of them. The fourth stays open.
Reality
Landlock has been in mainline since kernel 5.13 and needs no policy file and no administrator to confine a process to named paths. The dev.to walkthrough explaining it leaves the enforcing syscall inside a comment.
Reality
The fixes are already upstream, so the work now is confirming your distribution shipped them before someone with a low-privileged shell on a shared host uses the published code to reach root.
Reality
CVE-2026-31431 escalates a locally authenticated user or a compromised container workload to root through the Linux kernel's algif_aead interface. ABB has fixed it in Edgenius 3.2.4.1 for the bE100 gateway.
Reality
A two-week, $1m escape challenge against Vercel's Firecracker sandbox produced 1,285 reports. The most valuable one hit the Linux kernel networking stack that many clouds use to isolate tenants, and its CVEs are pending.
Reality
CSAIL researchers timed an interrupt to land inside the gap AMD's saferet defense leaves open, then pulled the root password file off a current Linux kernel. AMD has shipped a mitigation. Intel's picture is messier.
Reality
Kaspersky's Q2 2026 figures credit AI with both writing the bugs and finding them. The disclosures carrying working exploit code never got a CVE identifier at all.
Reality