{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:29:01.080Z",
  "tag": {
    "id": "linux",
    "label": "Linux",
    "isStack": true,
    "url": "https://pwn.watch/t/linux",
    "feed": "https://pwn.watch/t/linux/feed.xml"
  },
  "counts": {
    "incidents": 22,
    "live": 3,
    "notFullyPatched": 2,
    "patched": 20
  },
  "incidents": [
    {
      "slug": "linux-kernel-zdi-reports-leaked-to-lkml",
      "title": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml",
      "json": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "unpatched",
      "product": "Linux kernel: ksmbd (in-kernel SMB server) and SMB Direct, skbuff/NFQUEUE networking, vmwgfx, nvmet",
      "tags": [
        "linux",
        "ksmbd",
        "zdi",
        "rce"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Reports were tested on Linux 7.3-rc1 and 7.3-rc3 (Debian trixie); exact first affected versions not published",
        "ksmbd RCEs only matter if the in-kernel SMB server (ksmbd) is loaded and serving shares; SMB Direct bug needs an RDMA device and CONFIG_SMB_SERVER_SMBDIRECT"
      ],
      "fixedVersions": [
        "No fixed mainline or stable kernel yet",
        "ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release",
        "SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:02:00+02:00",
      "summary": "On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.",
      "xPost": null
    },
    {
      "slug": "isc-bind-cve-2026-94300",
      "title": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300",
      "json": "https://pwn.watch/i/isc-bind-cve-2026-94300.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "partial",
      "product": "ISC BIND 9 (named) DNS server",
      "tags": [
        "linux",
        "bind",
        "dns",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-94300"
      ],
      "affectedVersions": [
        "BIND 9.11.0 through 9.18.50",
        "BIND 9.20.0 through 9.20.29",
        "BIND 9.21.0 through 9.21.26",
        "BIND Supported Preview Edition 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.29-S1"
      ],
      "fixedVersions": [
        "BIND 9.20.30",
        "BIND 9.21.27",
        "BIND Supported Preview Edition 9.20.30-S1",
        "Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T15:59:23+02:00",
      "summary": "ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.",
      "xPost": null
    },
    {
      "slug": "pwnescape-cve-2026-99999",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999",
      "json": "https://pwn.watch/i/pwnescape-cve-2026-99999.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Linux kernel networking (host side of KVM/Firecracker and similar)",
      "tags": [
        "linux",
        "vercel",
        "kvm",
        "firecracker"
      ],
      "cveIds": [
        "CVE-2026-99999"
      ],
      "affectedVersions": [
        "Kernels before stable backports such as 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11 (verify vendor packages)"
      ],
      "fixedVersions": [
        "Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros"
      ],
      "startedAt": "2026-10-08",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:18:00+02:00",
      "summary": "Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2025-39964",
      "title": "Linux Kernel: Linux Kernel Race Condition Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2025-39964",
      "json": "https://pwn.watch/i/linux-kernel-cve-2025-39964.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-39964",
        "CVE-2026-53266",
        "CVE-2025-39682"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-18",
      "closedAt": "2026-09-18",
      "updatedAt": "2026-09-18",
      "summary": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2026-53362",
      "title": "Linux Kernel: Linux Kernel Unspecified Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2026-53362",
      "json": "https://pwn.watch/i/linux-kernel-cve-2026-53362.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-53362"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-08-27",
      "closedAt": "2026-08-27",
      "updatedAt": "2026-08-27",
      "summary": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. Added to CISA KEV on 2026-08-27.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2026-31431",
      "title": "Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2026-31431",
      "json": "https://pwn.watch/i/linux-kernel-cve-2026-31431.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-31431"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-01",
      "closedAt": "2026-05-01",
      "updatedAt": "2026-05-01",
      "summary": "Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. Added to CISA KEV on 2026-05-01.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2021-22555",
      "title": "Linux Kernel: Kernel Heap Out-of-Bounds Write Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2021-22555",
      "json": "https://pwn.watch/i/linux-kernel-cve-2021-22555.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2021-22555"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-06",
      "closedAt": "2025-10-06",
      "updatedAt": "2025-10-06",
      "summary": "Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Added to CISA KEV on 2025-10-06.",
      "xPost": null
    },
    {
      "slug": "gnu-bash-cve-2014-6278",
      "title": "GNU Bash: Bash OS Command Injection Vulnerability",
      "url": "https://pwn.watch/i/gnu-bash-cve-2014-6278",
      "json": "https://pwn.watch/i/gnu-bash-cve-2014-6278.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GNU Bash",
      "tags": [
        "linux",
        "bash",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2014-6278"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-10-02",
      "closedAt": "2025-10-02",
      "updatedAt": "2025-10-02",
      "summary": "GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. Added to CISA KEV on 2025-10-02.",
      "xPost": null
    },
    {
      "slug": "sudo-cve-2025-32463",
      "title": "Sudo: Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
      "url": "https://pwn.watch/i/sudo-cve-2025-32463",
      "json": "https://pwn.watch/i/sudo-cve-2025-32463.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Sudo",
      "tags": [
        "linux",
        "sudo",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-32463"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-29",
      "closedAt": "2025-09-29",
      "updatedAt": "2025-09-29",
      "summary": "Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Added to CISA KEV on 2025-09-29.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2025-38352",
      "title": "Linux Kernel: Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2025-38352",
      "json": "https://pwn.watch/i/linux-kernel-cve-2025-38352.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-38352"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-04",
      "closedAt": "2025-09-04",
      "updatedAt": "2025-09-04",
      "summary": "Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability. Added to CISA KEV on 2025-09-04.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2023-0386",
      "title": "Linux Kernel: Kernel Improper Ownership Management Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0386",
      "json": "https://pwn.watch/i/linux-kernel-cve-2023-0386.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-0386"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-17",
      "closedAt": "2025-06-17",
      "updatedAt": "2025-06-17",
      "summary": "Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Added to CISA KEV on 2025-06-17.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2024-53150",
      "title": "Linux Kernel: 2 exploited vulnerabilities (CVE-2024-53150, CVE-2024-53197)",
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-53150",
      "json": "https://pwn.watch/i/linux-kernel-cve-2024-53150.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-53150",
        "CVE-2024-53197"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-04-09",
      "closedAt": "2025-04-09",
      "updatedAt": "2025-04-09",
      "summary": "CVE-2024-53150: Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. CVE-2024-53197: Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. Added to CISA KEV on 2025-04-09.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2024-50302",
      "title": "Linux Kernel: Kernel Use of Uninitialized Resource Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-50302",
      "json": "https://pwn.watch/i/linux-kernel-cve-2024-50302.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-50302"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-03-04",
      "closedAt": "2025-03-04",
      "updatedAt": "2025-03-04",
      "summary": "The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report. Added to CISA KEV on 2025-03-04.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2024-53104",
      "title": "Linux Kernel: Kernel Out-of-Bounds Write Vulnerability",
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-53104",
      "json": "https://pwn.watch/i/linux-kernel-cve-2024-53104.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-53104"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-05",
      "closedAt": "2025-02-05",
      "updatedAt": "2025-02-05",
      "summary": "Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. Added to CISA KEV on 2025-02-05.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2017-1000253",
      "title": "Linux Kernel PIE Stack Buffer Corruption",
      "url": "https://pwn.watch/i/linux-kernel-cve-2017-1000253",
      "json": "https://pwn.watch/i/linux-kernel-cve-2017-1000253.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2017-1000253"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-09-09",
      "closedAt": "2024-09-09",
      "updatedAt": "2024-09-09",
      "summary": "Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns. CVE-2017-1000253 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2022-0185",
      "title": "Linux Kernel Heap-Based Buffer Overflow",
      "url": "https://pwn.watch/i/linux-kernel-cve-2022-0185",
      "json": "https://pwn.watch/i/linux-kernel-cve-2022-0185.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2022-0185"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-21",
      "closedAt": "2024-08-21",
      "updatedAt": "2024-08-21",
      "summary": "Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. Added to the CISA KEV catalog on 2024-08-21. CVE-2022-0185 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "openssh-regresshion-cve-2024-6387",
      "title": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)",
      "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387",
      "json": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "OpenSSH sshd (glibc-based Linux)",
      "tags": [
        "linux",
        "openssh",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-6387"
      ],
      "affectedVersions": [
        "8.5p1 up to (not including) 9.8p1",
        "Versions before 4.4p1 unless patched for CVE-2006-5051 and CVE-2008-4109 (Qualys)"
      ],
      "fixedVersions": [
        "9.8p1"
      ],
      "startedAt": "2024-07-01",
      "closedAt": "2024-07-01",
      "updatedAt": "2024-07-01",
      "summary": "Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.",
      "xPost": null
    },
    {
      "slug": "xz-utils-backdoor-cve-2024-3094",
      "title": "xz-utils backdoor (CVE-2024-3094)",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094",
      "json": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "XZ Utils (liblzma)",
      "tags": [
        "linux",
        "xz-utils",
        "openssh",
        "supply-chain",
        "backdoor",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-3094"
      ],
      "affectedVersions": [
        "5.6.0",
        "5.6.1"
      ],
      "fixedVersions": [
        "Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)",
        "5.6.2 clean release (2024-05-29, tukaani.org)"
      ],
      "startedAt": "2024-03-29",
      "closedAt": "2024-05-29",
      "updatedAt": "2024-05-29",
      "summary": "A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "title": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "json": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "privilege-escalation",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-1086"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-31",
      "closedAt": "2024-05-30",
      "updatedAt": "2024-05-30",
      "summary": "Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2022-2586",
      "title": "Linux Kernel Use-After-Free",
      "url": "https://pwn.watch/i/linux-kernel-cve-2022-2586",
      "json": "https://pwn.watch/i/linux-kernel-cve-2022-2586.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2022-2586"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-01-08",
      "closedAt": "2024-06-26",
      "updatedAt": "2024-06-26",
      "summary": "Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-2586 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "glibc-looney-tunables-cve-2023-4911",
      "title": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911",
      "json": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "GNU C Library (glibc) ld.so",
      "tags": [
        "linux",
        "glibc",
        "privilege-escalation",
        "kinsing",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-4911"
      ],
      "affectedVersions": [
        "glibc 2.34 and later before distro fixes (per Qualys)"
      ],
      "fixedVersions": [
        "See your distribution's advisory"
      ],
      "startedAt": "2023-10-03",
      "closedAt": "2023-11-21",
      "updatedAt": "2023-11-21",
      "summary": "A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.",
      "xPost": null
    },
    {
      "slug": "linux-kernel-cve-2023-0266",
      "title": "Linux Kernel: Use-After-Free (CVE-2023-0266)",
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0266",
      "json": "https://pwn.watch/i/linux-kernel-cve-2023-0266.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Linux Kernel",
      "tags": [
        "linux",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-0266"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-03-30",
      "closedAt": "2023-03-30",
      "updatedAt": "2023-03-30",
      "summary": "Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. Added to CISA KEV on 2023-03-30.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "情報の灯台",
      "handle": "joho_no_todai",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2112591874821398528/vSKACoJ9_bigger.jpg",
      "text": "Linuxカーネルの未修正脆弱性が、再現コードつきで公開メーリングリストに流れた。\nhttps://t.co/VzG4TT7bJz\n\n送ったのはTrend Micro傘下のZDI。\n\n宛先にはsecurity@kernel.orgが指定されていたが、Ccに公開リスト（linux-kernel等）が含まれていた。\n\nCVSS 9.0が2件。\n\nいずれもカーネル内蔵SMBサーバーksmbdの問題で、RDMAデバイスとSMB Directを使う構成が影響を受ける。\n\nLinuxカーネルのナンバー2、Greg Kroah-Hartman氏はパッチなしで公開リストに送られたことを問題視し、報告プロセスの修正を求めている。\n\nZDIの正式なアドバイザリ公開は2027年2月予定。\n技術詳細はすでに読める。",
      "date": "2026-10-22T12:31:20.000Z",
      "url": "https://x.com/joho_no_todai/status/2113246828997329182",
      "media": [],
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "authorName": "dip497",
      "handle": "Griflet497",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2038899595338756096/VMloeCi4_bigger.jpg",
      "text": "Trend Micro's ZDI posted unpatched Linux kernel bugs to the public mailing list by mistake.\n\n- ksmbd race: RCE, CVSS 9.0\n- SMB Direct underflow: RCE, CVSS 9.0\n- skb_zerocopy: local privilege escalation\n\nNo mainline fix yet. Anyone actually running ksmbd in production? https://t.co/OAxNNSvdtG",
      "date": "2026-10-22T12:11:03.000Z",
      "url": "https://x.com/Griflet497/status/2113241724026040718",
      "media": [],
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "authorName": "Abhay अभय",
      "handle": "abyzz",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2077228355368484867/d6V_ACTZ_bigger.jpg",
      "text": "BIND 9 DNS: replaying GSS-TSIG signed UDP messages can corrupt memory in named. Worst case: remote code execution. CVSS 8.1, no workaround. No known exploits yet.\n\nUpgrade to 9.20.30 / 9.21.27. On 9.18? Check with ISC.\nhttps://t.co/s2ChkYWdYG",
      "date": "2026-10-22T11:04:54.000Z",
      "url": "https://x.com/abyzz/status/2113225077248741652",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "Phoronix",
      "handle": "phoronix",
      "avatarUrl": "https://pbs.twimg.com/profile_images/937312281662279682/bqi_9AN2_bigger.jpg",
      "text": "Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List\n\nAs high as CVSS 9.0. Whoops.\n\nhttps://t.co/opCRSE80Vq",
      "date": "2026-10-22T10:07:35.000Z",
      "url": "https://x.com/phoronix/status/2113210651371819361",
      "media": [],
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "authorName": "Hensen Juang",
      "handle": "basedjensen",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2101681466476544000/S_hcWgNC_bigger.jpg",
      "text": "Bruh... DNS infa is fucked. Update your bind boys https://t.co/Gbll8AK5g2 https://t.co/BParNla6y9",
      "date": "2026-10-22T08:39:08.000Z",
      "url": "https://x.com/basedjensen/status/2113188391722627207",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVONoxnaYAAc7W-.jpg"
        }
      ],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "日本レジストリサービス（JPRS）",
      "handle": "JPRS_official",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1335820126499663872/xX3MDdt__bigger.jpg",
      "text": "（緊急）BIND 9.xの脆弱性（DNSサービスの停止・リモートコード実行）について（CVE-2026-94300） - バージョンアップを強く推奨 -\nhttps://t.co/1GT8uIFYT0",
      "date": "2026-10-22T06:41:12.000Z",
      "url": "https://x.com/JPRS_official/status/2113158713569882272",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "ɐʞsǝs",
      "handle": "akses_0x00",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067286904039702533/Q4ky91Ed_bigger.jpg",
      "text": "is it time to turn the internet off yet \nhttps://t.co/RLrPu79z8g",
      "date": "2026-10-22T04:18:08.000Z",
      "url": "https://x.com/akses_0x00/status/2113122707789553888",
      "media": [],
      "incident": "isc-bind-cve-2026-94300"
    },
    {
      "authorName": "Smukx.E",
      "handle": "5mukx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2091240145597149184/VgritadL_bigger.jpg",
      "text": "PwnEscape-Ai Research: Guest-to-Host KVM Escape (CVE-2026-99999). \n\nTLDR;- How a $1 million sandbox challenge led us to a vulnerability in Linux networking, repeatable host-memory disclosure, and ultimately a full guest-to-host escape.\n\nBlog:- https://t.co/CJERkG4rsE https://t.co/gdXbOvkklw",
      "date": "2026-10-20T17:15:55.000Z",
      "url": "https://x.com/5mukx/status/2112593667601125676",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVFwRXXaMAAvIvQ.jpg"
        }
      ],
      "incident": "pwnescape-cve-2026-99999"
    },
    {
      "authorName": "blackorbird",
      "handle": "blackorbird",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1390264140908748806/I8nxLuzB_bigger.jpg",
      "text": "How can one obtain such a great identifier as CVE-2026-99999? #PwnEscape",
      "date": "2026-10-19T08:17:27.000Z",
      "url": "https://x.com/blackorbird/status/2112095772124864777",
      "media": [],
      "incident": "pwnescape-cve-2026-99999"
    },
    {
      "authorName": "The Daily Tech Feed",
      "handle": "dailytechonx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg",
      "text": "Just uncovered: the “PwnEscape” Linux kernel flaw (CVE-2026-99999) lets guest VMs read host memory. A 9.3/10 critical issue, exposed via crafted packets in Vercel’s sandbox and patched in recent kernel versions. If you run shared Linux hosts, updating is mandatory. https://t.co/mqBjjVqe1d",
      "date": "2026-10-15T20:41:18.000Z",
      "url": "https://x.com/dailytechonx/status/2110833417642291284",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HUsvzsdWsAAq8Wp.jpg"
        }
      ],
      "incident": "pwnescape-cve-2026-99999"
    }
  ],
  "changes": [
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-10-22",
      "title": "Greg Kroah-Hartman replies to the reports: \"For some reason you sent this to public lists, and did not include a patch\" and \"Please fix your submission process...\"",
      "body": null,
      "sourceUrl": "https://lore.kernel.org/dri-devel/2026102254-protector-seventy-6454@gregkh/",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-10-22",
      "title": "Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon.",
      "body": null,
      "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830CECF5D0871064C59BA0280662@BYAPR01MB3830.prod.exchangelabs.com/",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-10-22",
      "title": "Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree.",
      "body": null,
      "sourceUrl": "https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable.",
      "body": null,
      "sourceUrl": "https://security-tracker.debian.org/tracker/CVE-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade.",
      "body": null,
      "sourceUrl": "https://x.com/JPRS_official/status/2113158713569882272",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-10-21",
      "title": "ZDI sends ZDI-CAN-33549, 33774, 33367, 34068 and 34076 to security@kernel.org with public lists (linux-kernel, linux-cifs, netdev, dri-devel) in Cc.",
      "body": null,
      "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-10-21",
      "title": "Stefan Metzmacher asks the reporter to test his for-7.5/smbdirect branch, saying the SMB Direct bug is probably already fixed there.",
      "body": null,
      "sourceUrl": "https://lore.kernel.org/lkml/BYAPR01MB3830472B5702C089B0BBB77D80662@BYAPR01MB3830.prod.exchangelabs.com/",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "isc-bind-cve-2026-94300",
      "incidentTitle": "ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)",
      "severity": "high",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-14",
      "title": "ISC sends early notification of the flaw to its customers.",
      "body": null,
      "sourceUrl": "https://kb.isc.org/docs/cve-2026-94300",
      "url": "https://pwn.watch/i/isc-bind-cve-2026-94300"
    },
    {
      "incident": "pwnescape-cve-2026-99999",
      "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-14/15",
      "title": "Mainline merge / public write-ups.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999"
    },
    {
      "incident": "pwnescape-cve-2026-99999",
      "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-07/08",
      "title": "Upstream IPv4 checksum guard accepted into net.git.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999"
    },
    {
      "incident": "linux-kernel-zdi-reports-leaked-to-lkml",
      "incidentTitle": "Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "unpatched",
      "date": "2026-09-30",
      "title": "Namjae Jeon commits a ksmbd fix for the negotiation race (\"ksmbd: wait for negotiation before receiving another PDU\") after a separate report.",
      "body": null,
      "sourceUrl": "https://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb.git/commit/?id=68f410faedaf6ee74d81e574733c50ebcc1bd8ed",
      "url": "https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml"
    },
    {
      "incident": "linux-kernel-cve-2025-39964",
      "incidentTitle": "Linux Kernel: Linux Kernel Race Condition Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-18",
      "title": "CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2025-39964"
    },
    {
      "incident": "linux-kernel-cve-2026-53362",
      "incidentTitle": "Linux Kernel: Linux Kernel Unspecified Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-08-27",
      "title": "CISA added CVE-2026-53362 to the KEV catalog (due 2026-08-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2026-53362"
    },
    {
      "incident": "pwnescape-cve-2026-99999",
      "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-20",
      "title": "Initial host-memory disclosure reported.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999"
    },
    {
      "incident": "pwnescape-cve-2026-99999",
      "incidentTitle": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-08-18",
      "title": "Vercel Sandbox challenge opens.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999"
    },
    {
      "incident": "linux-kernel-cve-2026-31431",
      "incidentTitle": "Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-01",
      "title": "CISA added CVE-2026-31431 to the KEV catalog (due 2026-05-15).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2026-31431"
    },
    {
      "incident": "linux-kernel-cve-2021-22555",
      "incidentTitle": "Linux Kernel: Kernel Heap Out-of-Bounds Write Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-06",
      "title": "CISA added CVE-2021-22555 to the KEV catalog (due 2025-10-27).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2021-22555"
    },
    {
      "incident": "gnu-bash-cve-2014-6278",
      "incidentTitle": "GNU Bash: Bash OS Command Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-02",
      "title": "CISA added CVE-2014-6278 to the KEV catalog (due 2025-10-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/gnu-bash-cve-2014-6278"
    },
    {
      "incident": "sudo-cve-2025-32463",
      "incidentTitle": "Sudo: Inclusion of Functionality from Untrusted Control Sphere Vulnerability",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-29",
      "title": "CISA added CVE-2025-32463 to the KEV catalog (due 2025-10-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/sudo-cve-2025-32463"
    },
    {
      "incident": "linux-kernel-cve-2025-38352",
      "incidentTitle": "Linux Kernel: Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-04",
      "title": "CISA added CVE-2025-38352 to the KEV catalog (due 2025-09-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2025-38352"
    },
    {
      "incident": "linux-kernel-cve-2023-0386",
      "incidentTitle": "Linux Kernel: Kernel Improper Ownership Management Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-17",
      "title": "CISA added CVE-2023-0386 to the KEV catalog (due 2025-07-08).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0386"
    },
    {
      "incident": "linux-kernel-cve-2024-53150",
      "incidentTitle": "Linux Kernel: 2 exploited vulnerabilities (CVE-2024-53150, CVE-2024-53197)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-09",
      "title": "CISA added CVE-2024-53150 to the KEV catalog (due 2025-04-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-53150"
    },
    {
      "incident": "linux-kernel-cve-2024-53150",
      "incidentTitle": "Linux Kernel: 2 exploited vulnerabilities (CVE-2024-53150, CVE-2024-53197)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-04-09",
      "title": "CISA added CVE-2024-53197 to the KEV catalog (due 2025-04-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-53150"
    },
    {
      "incident": "linux-kernel-cve-2024-50302",
      "incidentTitle": "Linux Kernel: Kernel Use of Uninitialized Resource Vulnerability",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-03-04",
      "title": "CISA added CVE-2024-50302 to the KEV catalog (due 2025-03-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-50302"
    },
    {
      "incident": "linux-kernel-cve-2024-53104",
      "incidentTitle": "Linux Kernel: Kernel Out-of-Bounds Write Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-05",
      "title": "CISA added CVE-2024-53104 to the KEV catalog (due 2025-02-26).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2024-53104"
    },
    {
      "incident": "linux-kernel-cve-2017-1000253",
      "incidentTitle": "Linux Kernel PIE Stack Buffer Corruption",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-09-09",
      "title": "CISA added CVE-2017-1000253 to the KEV catalog (federal deadline 2024-09-30)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/linux-kernel-cve-2017-1000253"
    },
    {
      "incident": "linux-kernel-cve-2022-0185",
      "incidentTitle": "Linux Kernel Heap-Based Buffer Overflow",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-21",
      "title": "CISA added CVE-2022-0185 to the KEV catalog (federal deadline 2024-09-11)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/linux-kernel-cve-2022-0185"
    },
    {
      "incident": "openssh-regresshion-cve-2024-6387",
      "incidentTitle": "regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-01",
      "title": "Qualys discloses regreSSHion; OpenSSH 9.8p1 released with the fix",
      "body": null,
      "sourceUrl": "https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server",
      "url": "https://pwn.watch/i/openssh-regresshion-cve-2024-6387"
    },
    {
      "incident": "linux-kernel-cve-2022-2586",
      "incidentTitle": "Linux Kernel Use-After-Free",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-26",
      "title": "CISA added CVE-2022-2586 to the KEV catalog (federal deadline 2024-07-17)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/linux-kernel-cve-2022-2586"
    },
    {
      "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-30",
      "title": "CISA added CVE-2024-1086 to the KEV catalog (federal deadline 2024-06-20)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-29",
      "title": "Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-09",
      "title": "XZ Git repositories available on GitHub again",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-30",
      "title": "xz@tukaani.org stops forwarding to Jia Tan",
      "body": null,
      "sourceUrl": "https://tukaani.org/xz-backdoor/",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Andres Freund discloses the backdoor on oss-security",
      "body": null,
      "sourceUrl": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "xz-utils-backdoor-cve-2024-3094",
      "incidentTitle": "xz-utils backdoor (CVE-2024-3094)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-29",
      "title": "Red Hat urgent security alert for Fedora 41 and Rawhide users",
      "body": null,
      "sourceUrl": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
      "url": "https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094"
    },
    {
      "incident": "linux-kernel-nf-tables-use-after-free-cve-2024-1086",
      "incidentTitle": "Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-31",
      "title": "CVE-2024-1086 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086",
      "url": "https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086"
    },
    {
      "incident": "linux-kernel-cve-2022-2586",
      "incidentTitle": "Linux Kernel Use-After-Free",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-08",
      "title": "CVE-2022-2586 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-2586",
      "url": "https://pwn.watch/i/linux-kernel-cve-2022-2586"
    },
    {
      "incident": "glibc-looney-tunables-cve-2023-4911",
      "incidentTitle": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-21",
      "title": "CISA adds CVE-2023-4911 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911"
    },
    {
      "incident": "glibc-looney-tunables-cve-2023-4911",
      "incidentTitle": "Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-03",
      "title": "Qualys discloses Looney Tunables; distros ship patched glibc",
      "body": null,
      "sourceUrl": "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so",
      "url": "https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911"
    },
    {
      "incident": "linux-kernel-cve-2023-0266",
      "incidentTitle": "Linux Kernel: Use-After-Free (CVE-2023-0266)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "CISA added CVE-2023-0266 to the KEV catalog (due 2023-04-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/linux-kernel-cve-2023-0266"
    }
  ]
}