Tag

Linux Kernel

All articles tagged with #linux kernel

security16 days ago•3 min saved

Ancient Linux SCTP bug lets local attackers gain root and escape containers

A long-standing use-after-free in Linux SCTP (CVE-2026-64564, nicknamed SCTPhantom) can allow a local user to gain root on a host and escape containers when SCTP is reachable; patches landed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 as of August 3. Tencent Zhuque Lab demonstrated root on multiple distros, though no widespread public exploit has surfaced. Mitigate by upgrading to the patched kernels or blocking the SCTP module if not needed. The issue traces back to 2008 and affects many releases, with a related use-after-free fixed in the same patch; check your distro's tracker for coverage.

via The Hacker News|

#container-security #cve-2026-64564 #linux-kernel

technology27 days ago•4 min saved

Per-Core EPP Boost in AMD P-State Could Lift Steam Deck FPS

A patch series to the AMD P-State Linux driver adds an opt-in per-core Energy Performance Preference (EPP) boost that selectively raises busy cores to a performance state for short bursts. In tests on the Steam Deck running Civilization VI, 1%-low FPS improved by about 31.8% and p99 frame times also improved, though the patches require review before mainline and require enabling the epp_boost parameter to activate. This could boost Linux gaming on handhelds, but broader testing and kernel acceptance are still pending.

via Phoronix|

#amd #amd-pstate #eppboost

security1 month ago•4 min saved

Linux XFS reflink flaw could grant root via race condition

Qualys warns of RefluXFS, a nine-year-old race-condition in the XFS reflink feature (CVE-2026-64600) that enables local unprivileged users to overwrite blocks backing protected files and gain root on Linux kernels 4.11+. The attack clones a target file to a scratch file and races concurrent writes in the copy-on-write path, causing disk-block modifications that survive reboot and produce no kernel logs. Affected distros include RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, and CloudLinux, potentially impacting millions. Kernel patches are available and backported; reboot to verify. There are currently no reliable mitigations beyond patching.

via BleepingComputer|

#cve-2026-64600 #linux-kernel #privilege-escalation

technology1 month ago•11 min saved

Torvalds backs AI-powered coding in Linux, inviting critics to fork or walk away

Linus Torvalds says Linux is not anti-AI and supports using AI coding tools to improve the Linux kernel, arguing the tech’s merit over fear; he tells detractors they can fork the project or walk away, framing the stance as pragmatic rather than ideological, with the Sashiko AI-assisted code-review system cited in the broader AI-in-open-source debate.

via Ars Technica|

#ai-coding #linus-torvalds #linux-kernel

technology1 month ago•5 min saved

Torvalds: AI is a tool for Linux—and you can fork if you object

Linus Torvalds declares AI a useful tool in Linux development and will not back away from AI integration in the kernel, telling critics they can fork the project if they disagree. He’s echoed by other maintainers who see AI-assisted patches as increasingly real and valuable, signaling that AI is here to stay in open-source Linux development.

via ZDNET|

#ai #linus-torvalds #linux-kernel

technology1 month ago•4 min saved

Linus Torvalds Says Linux Embraces AI as a Tool, Not a Social Movement

Linus Torvalds reaffirmed that the Linux kernel is not anti-AI and should treat AI/LLMs as useful tools for developers. There is no mandate to use AI, and those uneasy with it can fork or walk away. The project remains tech-focused, with social aspects as a secondary benefit, decided on technical merit rather than fear of new tools.

via Phoronix|

#ai #linus-torvalds #linux-kernel

technology1 month ago•4 min saved

Bad Epoll: Tiny Timing Window Lets Unprivileged Users Root Linux and Android

A newly disclosed Linux kernel vulnerability, Bad Epoll (CVE-2026-46242), is a use-after-free race in the epoll subsystem that can let a non-privileged user gain root on Linux desktops, servers, and Android. The attacker exploits a six-instruction timing window to corrupt kernel memory, with broader reach via Chrome’s sandbox and Android support; a upstream patch is available (a6dc643c6931) and backports are expected for 6.4+ kernels, while older 6.1-based Android devices may be unaffected. A public PoC exists, but there’s no evidence of widespread exploitation yet.

via The Hacker News|

#android #epoll #linux-kernel

technology1 month ago•3 min saved

Linux 7.2 Kernel Clocks In Over 43 Million Lines of Code

The Linux 7.2 merge window is closing with the kernel source tree surpassing 43.9 million lines of code (43,898,743 total) across 108,158 files, including about 33.65 million code lines, 5.03 million comments, and 5.21 million blank lines. AMDGPU/AMDKFD remains the largest driver at roughly 6.36 million lines. 7.1 stood at ~42.92 million. RC1 is expected later today as the 7.2 release unfolds.

via Phoronix|

#amdgpu #code-count #linux

technology1 month ago•3 min saved

Linux kernel pedit COW flaw lets local users gain root by poisoning in-memory binaries

A Linux kernel flaw in the traffic-control pedit action (CVE-2026-46331, 'pedit COW') lets a local unprivileged user corrupt the in-memory page cache and inject a root payload into a cached setuid binary, yielding root access without touching disk. The exploit requires unprivileged user namespaces with CAP_NET_ADMIN and has been demonstrated on RHEL 10 and Debian 13; Ubuntu variants show mixed susceptibility due to AppArmor defaults. Patches have been released by vendors; recommended actions are patching and rebooting, or mitigating by disabling the act_pedit module or turning off unprivileged user namespaces. Because the overwrite hits memory, file-integrity scans may miss it, and a compromised host should be treated as such.

via The Hacker News|

#cve-2026-46331 #linux-kernel #memory-corruption

cybersecurity3 months ago•58 min saved

PoC Unleashes PinTheft Linux LPE, Unlocks Root Access

A proof-of-concept exploit named PinTheft has been published for a Linux kernel local privilege escalation, leveraging an RDS zerocopy double-free flaw to gain root access under specific kernel configurations. The PoC demonstrates a novel way to steal references via io_uring and overwrite in-memory pages, underscoring ongoing Linux kernel security challenges. Admins should apply latest patches or blacklist vulnerable modules to mitigate risk.

via CyberSecurityNews|

#cybersecurity #iouring #linux-kernel

technology3 months ago•9 min saved

Torvalds: AI is a powerful tool, not a replacement for programmers

Linus Torvalds says AI tools are reshaping Linux development by increasing commits and lowering entry barriers, but they also create social and security strains in open source. He introduced AI security disclosure guidelines, argued that AI won’t replace human programmers, and stressed that open source remains essential to managing complexity. The discussion also highlights burnout risks for maintainers due to flood-like AI bug reports and the need to understand the end result of AI-generated code, not just prompts.

via ZDNET|

#ai #linus-torvalds #linux-kernel

security3 months ago•2 min saved

Nine-Year-Old Linux Kernel Bug Lets Local Users Root on Major Distros

Qualys disclosed CVE-2026-46333, a nine-year-old Linux kernel privilege-escalation flaw in __ptrace_may_access() that can let an unprivileged local user read /etc/shadow, access SSH private keys, and execute commands as root on Debian, Fedora, and Ubuntu; a PoC is available, patches have been released, and mitigations include updating the kernel or setting kernel.yama.ptrace_scope=2 and rotating host keys.

via The Hacker News|

#cve-2026-46333 #debian-ubuntu-fedora #linux-kernel

cyber-security-news3 months ago•57 min saved

Public PoC Reveals Local Root Exploit for DirtyDecrypt Linux Kernel

A public proof‑of‑concept exploit for the DirtyDecrypt (DirtyCBC) Linux kernel local privilege escalation (CVE-2026-31635) has been released. It exploits a missing copy-on-write guard in rxgk_decrypt_skb() within the RxGK subsystem, enabling a local unprivileged user to overwrite privileged memory (including /etc/shadow, sudoers, and SUID binaries) and gain root. The upstream patch was merged on April 25, 2026, and affected kernels require RXGK to be enabled (CONFIG_RXGK=y/m). Rolling‑release distributions with unpatched kernels (e.g., Fedora Rawhide, Arch before patch, openSUSE Tumbleweed) are at risk, while distros that ship RXGK disabled (e.g., some Debian/RHEL/Ubuntu builds) are less affected. In containers and Kubernetes environments, the flaw can lead to container escapes and host compromise. Mitigations include upgrading the kernel package and rebooting; as a temporary workaround, blacklisting rxrpc, esp4, and esp6 can be used at the expense of IPsec/AFS functionality. Kubernetes operators should rebuild worker images with patched kernels and enforce strict pod security settings.

via CyberSecurityNews|

#cve-2026-31635 #cyber-security-news #dirtydecrypt

technology3 months ago•4 min saved

DirtyDecrypt PoC Unleashed: Linux Kernel Local Privilege Escalation (CVE-2026-31635)

A newly released PoC for CVE-2026-31635, aka DirtyDecrypt, enables local privilege escalation in the Linux kernel by exploiting a missing copy-on-write guard in rxgk_decrypt_skb. The flaw affects systems with CONFIG_RXGK (e.g., Fedora, Arch, openSUSE) and can write to privileged memory or the kernel page cache, with potential container escape paths. It’s linked to the Dirty Frag/Copy Fail family of flaws, and mitigations being discussed include a kernel runtime killswitch and Rocky Linux’s opt-in security repository to push urgent fixes before upstream patches.

via The Hacker News|

#cve-2026-31635 #dirtydecrypt #linux-kernel

technology3 months ago•3 min saved

Public PoC Reveals PinTheft Arch Linux Root Privilege Flaw

A publicly released PoC demonstrates PinTheft, a Linux local privilege escalation in the RDS zerocopy path that can yield root on Arch Linux by pinning user pages and stealing FOLL_PIN references through io_uring fixed buffers; exploitation requires the RDS module to be loaded (default on Arch among common distros), io_uring enabled, a readable SUID-root binary, and x86_64 support, which limits its practical attack surface. Users should patch with the latest kernel, and as a mitigation can unload the RDS modules and disable them via modprobe.d (install rds /bin/false and install rds_tcp /bin/false) until patches are deployed.

via BleepingComputer|

#arch-linux #linux-kernel #local-privilege-escalation