Linux

Overview Attribute Value CVE CVE-2026-64564 Name SCTPhantom Type Use-After-Free (UAF) → Local Privilege Escalation + Container Escape CVSS 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Affected Linux kernel 2.6.25 → 7.1.x (introduced 2007, ~18 years) Fixed 6.6.148, 6.12.101, 6.18.42, 7.1.6, mainline 7.2-rc5 Researcher Tencent Zhuque Lab (via Corvus AI pipeline) PoC ✅ Public (reproducible exploit demonstrated) CISA KEV ❌ Not yet listed Patch ✅ Upstream (mainline commit 9b2854f86f0b) What Is SCTPhantom? SCTPhantom is a use-after-free in the Linux kernel’s SCTP (Stream Control Transmission Protocol) Dynamic Address Reconfiguration implementation. An attacker who can reach the SCTP stack can trigger a stale-pointer dereference that leads to full root on the host — and, critically, escape a container to compromise the underlying host. ...

GhostLock: The 15-Year-Old Linux Kernel Bug AI Found Hiding in Plain Sight TL;DR An AI-powered security agent discovered a Linux kernel vulnerability that has existed in every major distribution since 2011. It allows any unprivileged local user to gain full root access with a 97% success rate. There is no practical mitigation — patch your kernel. Attribute Detail CVE CVE-2026-43499 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-416 (Use After Free) Affected Linux 2.6.39 through 7.0 Fixed Linux 7.1 (commit 3bfdc63936dd) Stable backports 6.1.177, 6.6.144, 6.12.95, 6.18.36, 7.0.13 Not backported 5.15.y, 5.10.y LTS Discovered by VEGA AI Agent (Nebula Security) Bounty $92,337 (Google kernelCTF) Prerequisites Local access, no special privileges, CONFIG_FUTEX_PI=y What Is GhostLock? GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s real-time mutex (rtmutex) priority-inheritance code. Specifically, it lives in the remove_waiter() function in kernel/locking/rtmutex.c. ...

CVE-2022-0492: Linux Kernel Cgroups v1 release_agent Container Escape Executive Summary CVE-2022-0492 is a privilege escalation vulnerability in the Linux kernel’s cgroup_release_agent_write function (kernel/cgroup/cgroup-v1.c). It allows a root process inside a container to escape to the host and gain full root privileges by abusing the cgroups v1 release_agent mechanism via user namespaces. Attribute Detail CVE CVE-2022-0492 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-862 (Missing Authorization) / CWE-287 (Improper Authentication) Affected Linux kernel v2.6.24 through v5.16.6 Fixed Linux 5.17-rc3 (commit 24f6008564183) Type Container escape via cgroups v1 release_agent CISA KEV ✅ Added June 2, 2026 — actively exploited Public PoC ✅ Multiple (GitHub) Background: What is release_agent? cgroups v1 has a feature called release_agent — a path to a binary the kernel executes as root when a process in a child cgroup terminates (if notify_on_release is enabled). It lives in any cgroup v1 root directory: ...

Overview Attribute Value CVE ID CVE-2026-43121 Related CVE-2026-23263 (page array leak, same subsystem) CVSS Score ~7.8 (est., NVD enrichment pending) Vendor Linux Kernel Component io_uring/ZCRX (zero-copy receive) Vulnerability Type Missing bounds check → OOB heap write; Race condition → double-free Affected Linux kernel 6.12–6.19 (CONFIG_IO_URING_ZCRX=y) Patched ✅ Commit 770594e (bounds check) + 003049b1c4fb (atomic race fix), backported to v6.18.16 Exploit Status ⚠️ PoC demonstrated (kernel module + userspace harness) KEV Added Not yet What Is ZCRX? io_uring’s ZCRX (zero-copy receive) is a subsystem new to Linux 6.15 that lets userspace receive network packets directly into a registered memory region — no kernel copy needed. The NIC DMAs into the region, the kernel posts a completion event, and the user returns the slot when done via a refill queue. ...

Overview Attribute Value CVE (ESP variant) CVE-2026-43284 CVE (RxRPC variant) CVE-2026-43500 (reserved, no patch yet) Name Dirty Frag Type Local Privilege Escalation (LPE) Affected Ubuntu 24.04, RHEL 10.1, CentOS Stream 10, AlmaLinux 10, Fedora 44, openSUSE Tumbleweed — effectively all major distros Effective Lifetime ~9 years (xfrm-ESP since 2017, RxRPC since 2023) Race Condition None — deterministic Researcher Hyunwoo Kim (@v4bel) PoC ✅ Public (github.com/V4bel/dirtyfrag) ESP Patch ✅ Merged to mainline (f4c50a4034e6) RxRPC Patch ❌ No patch in any tree yet What Is Dirty Frag? Dirty Frag is a vulnerability class — not a single bug — that extends the same lineage as Dirty Pipe (CVE-2022-0847) and Copy Fail (CVE-2026-31431). Where Dirty Pipe overwrites struct pipe_buffer and Copy Fail overwrites the AF_ALG scatterlist, Dirty Frag overwrites the frag member of struct sk_buff. ...

This week’s threat landscape is defined by four words: patch everything, immediately. A cPanel authentication bypass has been exploited in the wild since February. A nine-year-old Linux kernel flaw gives reliable root without winning a race condition. GitHub Enterprise had a command injection bug triggered by a single git push. And the Windows Shell spoofing patch from February? Incomplete — attackers are still stealing NTLM hashes through LNK files. Meanwhile in the lab, Momentum Fusion v3 shipped with swing mode, Max found .env files with group-readable permissions, and the homelab security posture needs tightening. ...

Overview Attribute Value CVE ID CVE-2026-31431 Name Copy Fail CVSS Score ~8.4 (High) Type Local Privilege Escalation (LPE) Affected All major Linux distributions since 2017 Tested Ubuntu 24.04, Amazon Linux 2023, RHEL 14.3, SUSE 16 Kernels 6.12, 6.17, 6.18 (and all back to 2017) Exploit Size 732 bytes (Python script) Dependencies Python 3.10+ (for os.splice), standard library only Race Condition None — deterministic, straight-line exploit Stealth Page cache corrupted; on-disk file and checksums unchanged What Makes Copy Fail Different Linux kernel privilege escalation bugs are not new. But Copy Fail stands apart from its predecessors in four critical ways: ...

Master the Shell Bash isn’t just a shell; it’s the glue that holds the modern homelab together. Whether you’re automating Nextcloud syncs or managing Proxmox VMs, knowing your way around a .sh file is essential. 1. The Shebang Always start your scripts with a proper shebang. #!/bin/bash is standard, but #!/usr/bin/env bash is more portable across different Linux distributions. #!/usr/bin/env bash 2. Variables Variables are case-sensitive and should not have spaces around the =. ...