pwn.watch: Linux incident updates

[critical] Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)

Thu, 22 Oct 2026 17:02:00 GMT

On Oct 21, Trend Micro's Zero Day Initiative sent several unpatched Linux kernel vulnerability reports to security@kernel.org but Cc'd the public linux-kernel and subsystem lists, so full technical details (code paths, KASAN traces) are now public before fixes ship. The worst are two ksmbd (in-kernel SMB server) remote code execution bugs that ZDI scores CVSS 9.0: an SMB Direct integer underflow (needs an RDMA device and a writable share) and a protocol-dispatch race (needs a guest share). Also leaked: an skb_zerocopy local privilege escalation (CVSS 7.8), a vmwgfx out-of-bounds write LPE, and an nvmet info leak. No CVEs yet and no fixed mainline or stable release; the ksmbd race fix sits in the ksmbd maintainer tree and an SMB Direct fix is in a branch aimed at Linux 7.5. No exploitation reported. Only machines running ksmbd are exposed to the RCEs.

Status: live · Patch: unpatched · Fixed in: No fixed mainline or stable kernel yet, ksmbd race (ZDI-CAN-33774): fix commit 68f410faedaf in the ksmbd maintainer tree (linkinjeon/smb.git), not yet in a release, SMB Direct underflow (ZDI-CAN-33549): likely fixed in Stefan Metzmacher's for-7.5/smbdirect branch (unconfirmed)

Latest updates:

2026-10-22: Greg Kroah-Hartman replies to the reports: "For some reason you sent this to public lists, and did not include a patch" and "Please fix your submission process..." (source)
2026-10-22: Eric Dumazet says a patch for the skb_zerocopy bug, reported by someone else a week earlier, will be available soon. (source)
2026-10-22: Phoronix reports the leak. ksmbd maintainer Namjae Jeon says the ksmbd race is already fixed in his tree. (source)

[high] ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)

Thu, 22 Oct 2026 13:59:23 GMT

ISC disclosed a remotely exploitable memory-corruption bug in BIND 9's named on Oct 21. An attacker who captures a GSS-TSIG signed UDP message (the Kerberos signing used for Active Directory-style dynamic DNS updates) can replay it while the negotiated key is still valid and, combined with crafted queries to a zone they control, may get remote code execution, or at least crash named. CVSS 8.1 (High). No workaround. Affects BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29 and 9.21.0 through 9.21.26. Fixed in 9.20.30 and 9.21.27; ISC lists no 9.18 fix. ISC knows of no active exploitation. Debian trixie has a fixed package; Debian bookworm and Ubuntu are still waiting.

Status: live · Patch: partial · Fixed in: BIND 9.20.30, BIND 9.21.27, BIND Supported Preview Edition 9.20.30-S1, Debian trixie: bind9 1:9.20.30-1~deb13u1 (DSA-6576-1); unstable 1:9.20.30-1

Latest updates:

2026-10-22: Debian publishes DSA-6576-1 with a fixed bind9 for trixie; bookworm (9.18) is still listed as vulnerable. (source)
2026-10-22: Japan's registry JPRS issues an urgent alert telling BIND operators to upgrade. (source)
2026-10-21: ISC publicly discloses CVE-2026-94300 and ships BIND 9.20.30 and 9.21.27. ISC found it in internal testing; Dave Aitel of OpenAI reported it independently. (source)

CVEs: CVE-2026-94300

[critical] PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)

Thu, 22 Oct 2026 09:18:00 GMT

Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.

Status: live · Patch: patched · Fixed in: Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros

Latest updates:

2026-10-14/15: Mainline merge / public write-ups.
2026-10-07/08: Upstream IPv4 checksum guard accepted into net.git.
2026-08-20: Initial host-memory disclosure reported.

CVEs: CVE-2026-99999

[high] Linux Kernel: Linux Kernel Race Condition Vulnerability

Fri, 18 Sep 2026 00:00:00 GMT

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-18: CISA added CVE-2025-39964, CVE-2026-53266, CVE-2025-39682 to the KEV catalog (due 2026-09-21).

CVEs: CVE-2025-39964, CVE-2026-53266, CVE-2025-39682

[high] Linux Kernel: Linux Kernel Unspecified Vulnerability

Thu, 27 Aug 2026 00:00:00 GMT

Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. Added to CISA KEV on 2026-08-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-08-27: CISA added CVE-2026-53362 to the KEV catalog (due 2026-08-30).

CVEs: CVE-2026-53362

[high] Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

Fri, 01 May 2026 00:00:00 GMT

Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation. Added to CISA KEV on 2026-05-01.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-01: CISA added CVE-2026-31431 to the KEV catalog (due 2026-05-15).

CVEs: CVE-2026-31431

[high] Linux Kernel: Kernel Heap Out-of-Bounds Write Vulnerability

Mon, 06 Oct 2025 00:00:00 GMT

Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Added to CISA KEV on 2025-10-06.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-06: CISA added CVE-2021-22555 to the KEV catalog (due 2025-10-27).

CVEs: CVE-2021-22555

[high] GNU Bash: Bash OS Command Injection Vulnerability

Thu, 02 Oct 2025 00:00:00 GMT

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment. Added to CISA KEV on 2025-10-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-10-02: CISA added CVE-2014-6278 to the KEV catalog (due 2025-10-23).

CVEs: CVE-2014-6278

[critical] Sudo: Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Mon, 29 Sep 2025 00:00:00 GMT

Sudo contains an inclusion of functionality from untrusted control sphere vulnerability. This vulnerability could allow local attacker to leverage sudo’s -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. Added to CISA KEV on 2025-09-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-29: CISA added CVE-2025-32463 to the KEV catalog (due 2025-10-20).

CVEs: CVE-2025-32463

[high] Linux Kernel: Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Thu, 04 Sep 2025 00:00:00 GMT

Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability. Added to CISA KEV on 2025-09-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-09-04: CISA added CVE-2025-38352 to the KEV catalog (due 2025-09-25).

CVEs: CVE-2025-38352

[high] Linux Kernel: Kernel Improper Ownership Management Vulnerability

Tue, 17 Jun 2025 00:00:00 GMT

Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Added to CISA KEV on 2025-06-17.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-17: CISA added CVE-2023-0386 to the KEV catalog (due 2025-07-08).

CVEs: CVE-2023-0386

[high] Linux Kernel: 2 exploited vulnerabilities (CVE-2024-53150, CVE-2024-53197)

Wed, 09 Apr 2025 00:00:00 GMT

CVE-2024-53150: Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information. CVE-2024-53197: Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code. Added to CISA KEV on 2025-04-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-04-09: CISA added CVE-2024-53150 to the KEV catalog (due 2025-04-30).
2025-04-09: CISA added CVE-2024-53197 to the KEV catalog (due 2025-04-30).

CVEs: CVE-2024-53150, CVE-2024-53197

[medium] Linux Kernel: Kernel Use of Uninitialized Resource Vulnerability

Tue, 04 Mar 2025 00:00:00 GMT

The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report. Added to CISA KEV on 2025-03-04.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-03-04: CISA added CVE-2024-50302 to the KEV catalog (due 2025-03-25).

CVEs: CVE-2024-50302

[high] Linux Kernel: Kernel Out-of-Bounds Write Vulnerability

Wed, 05 Feb 2025 00:00:00 GMT

Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. Added to CISA KEV on 2025-02-05.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-02-05: CISA added CVE-2024-53104 to the KEV catalog (due 2025-02-26).

CVEs: CVE-2024-53104

[high] Linux Kernel PIE Stack Buffer Corruption

Mon, 09 Sep 2024 00:00:00 GMT

Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns. CVE-2017-1000253 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-09-09: CISA added CVE-2017-1000253 to the KEV catalog (federal deadline 2024-09-30) (source)

CVEs: CVE-2017-1000253

[high] Linux Kernel Heap-Based Buffer Overflow

Wed, 21 Aug 2024 00:00:00 GMT

Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. Added to the CISA KEV catalog on 2024-08-21. CVE-2022-0185 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-08-21: CISA added CVE-2022-0185 to the KEV catalog (federal deadline 2024-09-11) (source)

CVEs: CVE-2022-0185

[high] regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)

Mon, 01 Jul 2024 00:00:00 GMT

Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.

Status: closed · Patch: patched · Fixed in: 9.8p1

Latest updates:

2024-07-01: Qualys discloses regreSSHion; OpenSSH 9.8p1 released with the fix (source)

CVEs: CVE-2024-6387

[medium] Linux Kernel Use-After-Free

Wed, 26 Jun 2024 00:00:00 GMT

Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-2586 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-06-26: CISA added CVE-2022-2586 to the KEV catalog (federal deadline 2024-07-17) (source)
2024-01-08: CVE-2022-2586 published (source)

CVEs: CVE-2022-2586

[high] Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root

Thu, 30 May 2024 00:00:00 GMT

Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-30: CISA added CVE-2024-1086 to the KEV catalog (federal deadline 2024-06-20) (source)
2024-01-31: CVE-2024-1086 published (source)

CVEs: CVE-2024-1086

[critical] xz-utils backdoor (CVE-2024-3094)

Wed, 29 May 2024 00:00:00 GMT

A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

Status: closed · Patch: patched · Fixed in: Downgrade to an uncompromised version such as 5.4.6 Stable (CISA), 5.6.2 clean release (2024-05-29, tukaani.org)

Latest updates:

2024-05-29: Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases (source)
2024-04-09: XZ Git repositories available on GitHub again (source)
2024-03-30: xz@tukaani.org stops forwarding to Jia Tan (source)

CVEs: CVE-2024-3094

[high] Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)

Tue, 21 Nov 2023 00:00:00 GMT

A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.

Status: closed · Patch: patched · Fixed in: See your distribution's advisory

Latest updates:

2023-11-21: CISA adds CVE-2023-4911 to the KEV catalog
2023-10-03: Qualys discloses Looney Tunables; distros ship patched glibc (source)

CVEs: CVE-2023-4911

[high] Linux Kernel: Use-After-Free (CVE-2023-0266)

Thu, 30 Mar 2023 00:00:00 GMT

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. Added to CISA KEV on 2023-03-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-03-30: CISA added CVE-2023-0266 to the KEV catalog (due 2023-04-20).

CVEs: CVE-2023-0266