# Linux security incidents · pwn.watch

> Security incidents affecting The Linux kernel on servers, VMs and containers.

Page: https://pwn.watch/t/linux · generated 2026-10-22T17:32:17.031Z

## Status (as of 2026-10-22)
- Incidents: 22 (3 live, 2 live and not fully patched, 20 patched)
- Days without a Linux security incident: 0 (2 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-21

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/linux.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/linux/feed.xml
- This file: https://pwn.watch/t/linux/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Linux kernel: unpatched ZDI bug reports with repro details leaked to public LKML (ksmbd RCE, CVSS 9.0)](https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml) ([json](https://pwn.watch/i/linux-kernel-zdi-reports-leaked-to-lkml.json)): critical, live, unpatched, started 2026-10-21
- [ISC BIND 9: replayed GSS-TSIG messages corrupt memory, possible RCE (CVE-2026-94300)](https://pwn.watch/i/isc-bind-cve-2026-94300) ([json](https://pwn.watch/i/isc-bind-cve-2026-94300.json)): high, live, partial, started 2026-10-21, CVE-2026-94300
- [PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)](https://pwn.watch/i/pwnescape-cve-2026-99999) ([json](https://pwn.watch/i/pwnescape-cve-2026-99999.json)): critical, live, patched, started 2026-10-08, CVE-2026-99999
- [Linux Kernel: Linux Kernel Race Condition Vulnerability](https://pwn.watch/i/linux-kernel-cve-2025-39964) ([json](https://pwn.watch/i/linux-kernel-cve-2025-39964.json)): high, closed, patched, started 2026-09-18, CVE-2025-39964, CVE-2026-53266, CVE-2025-39682
- [Linux Kernel: Linux Kernel Unspecified Vulnerability](https://pwn.watch/i/linux-kernel-cve-2026-53362) ([json](https://pwn.watch/i/linux-kernel-cve-2026-53362.json)): high, closed, patched, started 2026-08-27, CVE-2026-53362
- [Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability](https://pwn.watch/i/linux-kernel-cve-2026-31431) ([json](https://pwn.watch/i/linux-kernel-cve-2026-31431.json)): high, closed, patched, started 2026-05-01, CVE-2026-31431
- [Linux Kernel: Kernel Heap Out-of-Bounds Write Vulnerability](https://pwn.watch/i/linux-kernel-cve-2021-22555) ([json](https://pwn.watch/i/linux-kernel-cve-2021-22555.json)): high, closed, patched, started 2025-10-06, CVE-2021-22555
- [GNU Bash: Bash OS Command Injection Vulnerability](https://pwn.watch/i/gnu-bash-cve-2014-6278) ([json](https://pwn.watch/i/gnu-bash-cve-2014-6278.json)): high, closed, patched, started 2025-10-02, CVE-2014-6278
- [Sudo: Inclusion of Functionality from Untrusted Control Sphere Vulnerability](https://pwn.watch/i/sudo-cve-2025-32463) ([json](https://pwn.watch/i/sudo-cve-2025-32463.json)): critical, closed, patched, started 2025-09-29, CVE-2025-32463
- [Linux Kernel: Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability](https://pwn.watch/i/linux-kernel-cve-2025-38352) ([json](https://pwn.watch/i/linux-kernel-cve-2025-38352.json)): high, closed, patched, started 2025-09-04, CVE-2025-38352
- [Linux Kernel: Kernel Improper Ownership Management Vulnerability](https://pwn.watch/i/linux-kernel-cve-2023-0386) ([json](https://pwn.watch/i/linux-kernel-cve-2023-0386.json)): high, closed, patched, started 2025-06-17, CVE-2023-0386
- [Linux Kernel: 2 exploited vulnerabilities (CVE-2024-53150, CVE-2024-53197)](https://pwn.watch/i/linux-kernel-cve-2024-53150) ([json](https://pwn.watch/i/linux-kernel-cve-2024-53150.json)): high, closed, patched, started 2025-04-09, CVE-2024-53150, CVE-2024-53197
- [Linux Kernel: Kernel Use of Uninitialized Resource Vulnerability](https://pwn.watch/i/linux-kernel-cve-2024-50302) ([json](https://pwn.watch/i/linux-kernel-cve-2024-50302.json)): medium, closed, patched, started 2025-03-04, CVE-2024-50302
- [Linux Kernel: Kernel Out-of-Bounds Write Vulnerability](https://pwn.watch/i/linux-kernel-cve-2024-53104) ([json](https://pwn.watch/i/linux-kernel-cve-2024-53104.json)): high, closed, patched, started 2025-02-05, CVE-2024-53104
- [Linux Kernel PIE Stack Buffer Corruption](https://pwn.watch/i/linux-kernel-cve-2017-1000253) ([json](https://pwn.watch/i/linux-kernel-cve-2017-1000253.json)): high, closed, patched, started 2024-09-09, CVE-2017-1000253
- [Linux Kernel Heap-Based Buffer Overflow](https://pwn.watch/i/linux-kernel-cve-2022-0185) ([json](https://pwn.watch/i/linux-kernel-cve-2022-0185.json)): high, closed, patched, started 2024-08-21, CVE-2022-0185
- [regreSSHion: unauthenticated RCE in OpenSSH sshd (CVE-2024-6387)](https://pwn.watch/i/openssh-regresshion-cve-2024-6387) ([json](https://pwn.watch/i/openssh-regresshion-cve-2024-6387.json)): high, closed, patched, started 2024-07-01, CVE-2024-6387
- [xz-utils backdoor (CVE-2024-3094)](https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094) ([json](https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json)): critical, closed, patched, started 2024-03-29, CVE-2024-3094
- [Linux kernel nf_tables use-after-free (CVE-2024-1086) used for root](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086) ([json](https://pwn.watch/i/linux-kernel-nf-tables-use-after-free-cve-2024-1086.json)): high, closed, patched, started 2024-01-31, CVE-2024-1086
- [Linux Kernel Use-After-Free](https://pwn.watch/i/linux-kernel-cve-2022-2586) ([json](https://pwn.watch/i/linux-kernel-cve-2022-2586.json)): medium, closed, patched, started 2024-01-08, CVE-2022-2586
- [Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)](https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911) ([json](https://pwn.watch/i/glibc-looney-tunables-cve-2023-4911.json)): high, closed, patched, started 2023-10-03, CVE-2023-4911
- [Linux Kernel: Use-After-Free (CVE-2023-0266)](https://pwn.watch/i/linux-kernel-cve-2023-0266) ([json](https://pwn.watch/i/linux-kernel-cve-2023-0266.json)): high, closed, patched, started 2023-03-30, CVE-2023-0266