2026

Overview Attribute Value CVE CVE-2026-64564 Name SCTPhantom Type Use-After-Free (UAF) → Local Privilege Escalation + Container Escape CVSS 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Linux kernel 2.6.25 → 7.1.x (introduced 2007, ~18 years) Fixed 6.6.148, 6.12.101, 6.18.42, 7.1.6, mainline 7.2-rc5 Researcher Tencent Zhuque Lab (via Corvus AI pipeline) PoC ✅ Public (reproducible exploit demonstrated) CISA KEV ❌ Not yet listed Patch ✅ Upstream (mainline commit 9b2854f86f0b) What Is SCTPhantom? SCTPhantom is a use-after-free in the Linux kernel’s SCTP (Stream Control Transmission Protocol) Dynamic Address Reconfiguration implementation. An attacker who can reach the SCTP stack can trigger a stale-pointer dereference that leads to full root on the host — and, critically, escape a container to compromise the underlying host. ...

Overview Attribute CVE-2026-41091 CVE-2026-45498 Type Local Privilege Escalation Denial of Service Component Malware Protection Engine Antimalware Platform Affected Engine ≤ 1.1.26030.3008 Platform ≤ 4.18.26030.3011 CWE CWE-59 (Link Following) — Impact Standard user → SYSTEM Defender disabled / system unresponsive Exploit ✅ Active in the wild ✅ Active in the wild Patch Engine 1.1.26040.8 Platform 4.18.26040.7 CISA KEV ✅ Added 2026-05-20 ✅ Added 2026-05-20 FCEB Deadline June 3, 2026 June 3, 2026 Microsoft has started rolling out patches for two actively exploited zero-day vulnerabilities in Microsoft Defender. Both were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 20, with federal agencies ordered to patch within two weeks. ...

Overview Attribute Value CVE (ESP variant) CVE-2026-43284 CVE (RxRPC variant) CVE-2026-43500 (reserved, no patch yet) Name Dirty Frag Type Local Privilege Escalation (LPE) Affected Ubuntu 24.04, RHEL 10.1, CentOS Stream 10, AlmaLinux 10, Fedora 44, openSUSE Tumbleweed — effectively all major distros Effective Lifetime ~9 years (xfrm-ESP since 2017, RxRPC since 2023) Race Condition None — deterministic Researcher Hyunwoo Kim (@v4bel) PoC ✅ Public (github.com/V4bel/dirtyfrag) ESP Patch ✅ Merged to mainline (f4c50a4034e6) RxRPC Patch ❌ No patch in any tree yet What Is Dirty Frag? Dirty Frag is a vulnerability class — not a single bug — that extends the same lineage as Dirty Pipe (CVE-2022-0847) and Copy Fail (CVE-2026-31431). Where Dirty Pipe overwrites struct pipe_buffer and Copy Fail overwrites the AF_ALG scatterlist, Dirty Frag overwrites the frag member of struct sk_buff. ...

Overview Attribute Value CVE ID CVE-2026-31431 Name Copy Fail CVSS Score ~8.4 (High) Type Local Privilege Escalation (LPE) Affected All major Linux distributions since 2017 Tested Ubuntu 24.04, Amazon Linux 2023, RHEL 14.3, SUSE 16 Kernels 6.12, 6.17, 6.18 (and all back to 2017) Exploit Size 732 bytes (Python script) Dependencies Python 3.10+ (for os.splice), standard library only Race Condition None — deterministic, straight-line exploit Stealth Page cache corrupted; on-disk file and checksums unchanged What Makes Copy Fail Different Linux kernel privilege escalation bugs are not new. But Copy Fail stands apart from its predecessors in four critical ways: ...