#linuxkernel

Read Time:3 Minute, 21 Second

Technical reports describing several unpatched Linux-related security flaws appeared on public mailing lists in October, exposing implementation details before fixes were ready for general deployment. The most urgent findings are two CVSS 9.0 vulnerabilities in KSMBD, the SMB file server implemented inside the Linux kernel, that could lead to remote code execution.

The reports were submitted through Trend Micro’s Zero Day Initiative and credit an artificial-intelligence scanner with finding the defects. Linux maintainer Greg Kroah-Hartman questioned why submissions without patches were routed to public lists. Reporting on the incident also points to kernel guidance treating AI-discovered bugs as already public, leaving the exact reason for the disclosure route unclear.

Two critical bugs affect the in-kernel SMB serverThe first critical report, ZDI-CAN-33774, describes a race condition in KSMBD. A race occurs when concurrent operations interact in an unsafe order. Here, inconsistent handling of queued network requests may cause memory to be read or written beyond its intended boundary, potentially giving a remote attacker a route to execute code.

ZDI-CAN-33549, also rated 9.0, affects KSMBD’s SMB Direct functionality. An integer underflow can occur when a size calculation wraps after subtraction, producing an invalid length that is later used in a memory operation. The flaw concerns SMB Direct over RDMA networking, so systems not using that feature have a different exposure profile.

Neither finding should be confused with Samba. KSMBD is an optional kernel component, whereas Samba is a separate user-space implementation commonly used for file sharing. A Linux host running Samba alone is not automatically affected by these KSMBD reports. Administrators need to check what service and modules their systems actually use.

Public details arrived ahead of broad patchesAt the time of reporting, neither critical issue had a CVE identifier or a named correction in the mainline kernel and its integration tree. A change addressing the SMB Direct issue was reportedly present in development work intended for Linux 7.5, but code in a development branch is not equivalent to a patch shipped by stable kernels or Linux distributions.

This gap matters operationally. Kernel changes must be reviewed, merged, backported where appropriate, packaged by distributions, and installed by customers. Public technical information can help defenders identify affected configurations, yet it can also shorten the time attackers need to study a weakness while users still lack a supported update.

Four additional reports broaden the scopeOther disclosures cover unrelated components and impacts. ZDI-CAN-33367 concerns skb_zerocopy networking code and may allow local privilege escalation. ZDI-CAN-34068 describes an out-of-bounds write in the VMware graphics driver with a similar local elevation risk. ZDI-CAN-34076 involves an uninitialized resource in the NVMe over Fabrics target and may disclose information.

ZDI-CAN-32005 is a stack-buffer overflow in ConnMan’s processing of search-domain TCP queries. ConnMan is a network-management service rather than a Linux kernel component, so grouping every report under “kernel flaws” would be inaccurate. Each item needs its own configuration and package assessment.

Risk reduction while fixes are pendingOperators should first determine whether KSMBD is loaded, configured, and reachable. If the service is unnecessary, disabling it removes the immediate exposure to the two remote-code-execution reports. Where it is required, access should be limited to trusted networks, SMB Direct should be evaluated separately, and file-sharing activity should receive heightened monitoring.

Follow the security advisories issued by the system’s Linux distribution.

Do not assume a development-branch fix is present in a production kernel.

Restrict SMB services from untrusted networks and review share permissions.

Inventory ConnMan, VMware graphics, and NVMe-oF use independently.

Temporary exposure reduction cannot replace a vendor-approved update. Once distributions publish corrected kernels or packages, teams should test and deploy them promptly, accounting for the reboot typically required to activate a new kernel. Until then, precise inventory and network containment are more useful than treating every Linux system as equally vulnerable.

Linux 7.3 è arrivato con importanti novità per il gaming su Linux, la gestione della memoria video AMD, le prestazioni di ext4 e il supporto hardware. #Linux #LinuxKernel #Linux73 #AMD #GamingLinux #Ubuntu https://www.linuxeasy.org/linux-7-3-rilasciato-piu-prestazioni-per-ext4-gaming-amd-e-gestione-della-cpu/

Read Time:4 Minute, 4 Second

A newly disclosed Linux kernel vulnerability, nicknamed PwnEscape, is a reminder that virtual machine isolation depends on far more than the hypervisor sitting on top of it. The flaw, tracked as CVE-2026-99999, lives deep in the kernel’s networking stack and can let an attacker-controlled guest peek into host memory — and, under the right conditions, push further toward code execution on the host itself.

A Timing Bug in a Routine Performance TrickThe root cause is surprisingly mundane. Linux often defers calculating a network packet’s checksum until later in processing, a common performance optimization. Packet metadata tells the kernel where that checksum calculation should start and where the result should be written.

Researcher Paulos Yibelo found that this metadata could be manipulated so that a deferred checksum write altered the contents of a packet’s IPv4 header — after the kernel had already made decisions based on the header’s original values. In his proof-of-concept, a packet that initially looked like a standard 20-byte IPv4 header could be reinterpreted as a 60-byte header following the delayed write, tricking the fragmentation code into treating bytes beyond the packet’s valid data as legitimate header content.

The practical result: roughly 32 bytes of host memory leaked into an outgoing packet. On its own, that’s an information disclosure bug. But in a controlled lab environment, researchers chained that leak with careful memory-allocation manipulation to achieve targeted kernel-memory writes and ultimately execute a host-level helper process with root privileges.

Important CaveatsIt’s worth being precise about what has and hasn’t been demonstrated. The escalation from memory leak to root execution was reproduced on systems the researchers controlled themselves — it has not been shown as a working exploit against a live cloud provider’s production environment. The report also doesn’t claim every Linux-based hypervisor configuration is equally exposed. Still, the underlying flaw sits in shared kernel networking code rather than any single hypervisor’s implementation, which is exactly what makes it concerning for cloud operators running untrusted workloads side by side.

Which Kernels Are AffectedThe bug spans a wide range of long-term kernel branches. Fixed versions have been published for each affected line:

5.10 branch — fixed in 5.10.272

5.15 branch — fixed in 5.15.223

6.1 branch — fixed in 6.1.190

6.6 branch — fixed in 6.6.159

6.12 branch — fixed in 6.12.113

6.18 branch — fixed in 6.18.57

7.2 branch — fixed in 7.2.11

7.3 development series — fixed ahead of 7.3-rc7

The upstream patch adds a validation step before certain checksum-completion operations, confirming that the checksum start offset doesn’t fall inside the IPv4 header before allowing the write to proceed. Developers describe it as a defense-in-depth measure rather than a complete overhaul of how packet metadata is validated on input, so further hardening work may follow.

How the Bug SurfacedPwnEscape wasn’t found through routine kernel auditing — it emerged from Vercel’s $1 million Sandbox security challenge, a bug bounty built specifically to stress-test the company’s workload isolation. Yibelo reported the kernel flaw on just the third day of the two-week event, working from a standard sandbox environment with no special access. Vercel has called it the program’s single most important finding; across the full challenge, researchers submitted 1,285 reports and collected a combined $242,000 in bounties, with PwnEscape standing as the only critical-rated submission.

It’s not an isolated data point either. The same research community has recently surfaced a separate KVM escape issue and a distinct Linux vhost flaw with its own public proof-of-concept — different bugs, different root causes, and defenders shouldn’t assume a fix for one covers the others.

What Defenders Should DoFor organizations running virtual machines on Linux hosts — especially cloud providers and anyone hosting untrusted or multi-tenant workloads — the priority is straightforward:

Check your Linux distribution’s security advisories rather than relying on a raw version number, since vendors frequently backport fixes to older kernel releases.

Confirm the running kernel includes the checksum-validation fix described in the upstream commit for your branch.

Prioritize patching on hosts that run guest workloads from external or lower-trust tenants.

Continue monitoring for related findings, since this class of networking-stack bug appears to be an active area of research right now.

PwnEscape is a useful case study in how virtualization security really works in practice: isolation guarantees rest not just on the hypervisor, but on every piece of host operating system code a guest’s traffic touches along the way. When a check made early in packet processing no longer matches what a later stage of the kernel actually sees, that gap is exactly what attackers go looking for.

Ubuntu 26.10 “Stonking Stingray” si prepara a portare nuove funzionalità sul desktop Linux, con GNOME 51, Linux Kernel 7.3, uno stack grafico aggiornato e strumenti di sistema riscritti in Rust. #Ubuntu #Ubuntu2610 #Linux #GNOME51 #LinuxKernel https://www.linuxeasy.org/ubuntu-26-10-stonking-stingray-rilasciato-tutte-le-principali-novita-della-nuova-distribuzione-linux/

Read Time:4 Minute, 0 Second

Debian has published one of its larger security advisories in recent memory, bundling fixes for 1,313 CVE entries into a single Linux kernel update for its current stable release, Trixie. Debian security team member Salvatore Bonaccorso published the advisory, designated DSA-6528-1, on September 29, 2026, covering kernel source package version 6.12.111-1. The scale of the number alone has drawn attention, but understanding what it actually represents matters more than the headline figure.

What a 1,313-CVE Advisory Actually MeansIt’s tempting to read “1,313 flaws” as 1,313 separate holes actively being exploited across the internet, but that’s not what Debian’s advisory says. These are individual CVE identifiers rolled into one consolidated kernel update — not 1,313 distinct Debian packages, and not a confirmed count of real-world attacks. Debian’s own security team evaluates each CVE in the context of how the Debian kernel build actually uses the affected code, and lower-impact entries routinely get bundled in alongside more serious ones within the same advisory. A CVE identifier by itself doesn’t establish that a given system is seriously at risk; it establishes that a flaw exists somewhere in the kernel source tree that Debian decided was worth including in this patch cycle.

That said, the advisory is explicit about the categories of risk involved: privilege escalation, denial of service, and information leaks. Privilege escalation flaws can let an attacker who already has limited access on a system climb to higher permissions — potentially root — once they’re past the initial foothold. Denial-of-service issues threaten uptime and availability rather than confidentiality. Information leak bugs can expose data that was supposed to stay protected, such as kernel memory contents. Crucially, Debian’s advisory doesn’t provide a CVE-by-CVE technical breakdown, a shared root cause across the batch, or an overall severity score for the release as a whole — so any claim that the entire set enables remote takeover would be reading more into the advisory than it actually states.

Among the specific CVE identifiers named in coverage of the advisory are CVE-2024-52560, CVE-2025-21817, CVE-2026-23137, and CVE-2026-100079, spanning disclosures from 2024 through 2026 that had accumulated and were addressed together in this kernel refresh. For context on what a serious kernel privilege escalation bug can look like in isolation, Cyber Security News has previously covered CVE-2023-3390, an integer overflow in Netfilter that could allow writes to kernel memory and potentially grant root access — a useful illustration of the risk category, though that particular CVE is not among the ones addressed in this specific advisory.

Version Tracking Matters More Than the Headline CountFor administrators, the practically useful detail buried in the advisory is the version information: Debian’s security tracker flags Linux kernel version 6.12.107-1 in Trixie as vulnerable, with 6.12.111-1 from the security repository marked as the fixed version. That gives system administrators something concrete to check against their own fleets, rather than relying on a vague sense that “the system has been updated recently.”

How to Apply the Fix CorrectlyBecause this is a kernel update, simply downloading the new package isn’t the end of the process — the fix only takes effect once the system is actually running the patched kernel. The standard update sequence is straightforward:

Refresh package lists with sudo apt-get update, then apply available updates with sudo apt-get upgrade.

Remember that Debian’s advisories name source packages, so administrators need to confirm the relevant installed binary packages built from that source have actually been updated.

Schedule a reboot into the newly patched kernel, since kernel updates don’t take effect for a running system until restart.

After rebooting, verify the active kernel version with uname -r and cross-check it against the fixed version named in the advisory — note that the running kernel’s release string and the source package version use different formats, so a direct string match isn’t always obvious.

Debian’s security documentation also recommends enabling unattended-upgrades for automatic security patching. Automating the download-and-install step reduces how long systems sit exposed, but administrators should still independently confirm that kernel updates have actually taken effect post-reboot rather than assuming automation handled everything end to end. Keeping a record of the installed kernel package version, the time the update was applied, and confirmation of a successful reboot makes it far easier later to distinguish machines that merely downloaded the fix from those genuinely running the corrected kernel — a distinction that matters a great deal if an incident investigation ever needs to rule systems in or out.

For this release, the reference points worth keeping on hand are advisory DSA-6528-1 and the fixed Trixie kernel package version, 6.12.111-1.