LinuxSecurity.com

A cgroup namespace gives a Linux process a limited view of the control-group hierarchy that organizes workloads and accounts for resources.

Kubernetes released fixes on Sep 23, 2026 for a control-plane flaw that could create a pod outside the namespace where a user's permissions applied. CVE-2026-2270 affects kube-controller-manager, the service that runs several controllers responsible for bringing a cluster into line with its declared configuration. A namespace is meant to keep one group's resources separate from another's. Here, a user with permission to change two objects in one namespace could influence a controller that wor...

A Linux device driver can keep an open file alive while freeing the hardware state that file still needs.

Linux integrity checks depend on more than a correct policy or a trusted hash. The kernel must also keep that security state alive for the entire decision. A new patch series reports two places where Integrity Policy Enforcement could continue reading after policy or dm-verity data had been freed. Integrity Policy Enforcement, usually shortened to IPE, is a Linux Security Module that can allow or deny access according to integrity properties. dm-verity supplies read-only block-device verifica...

A Linux console font change could leave the framebuffer console with a buffer sized for 256 characters even after a 512-character font was installed.

A September 23 advisory describes a flaw in the Python SDK used with MCP Toolbox: a shared cache could send a Google ID token to a service it was not meant for.

A September 22 advisory on an Emacs vulnerability says opening a crafted file could run code on the reader's computer, even with the editor's default settings.

A newly merged Linux HID fix addresses a Wacom input-device path that could read beyond a short report and pass a value to local software.

Linux DAMON, the kernel's Data Access Monitor, samples memory use to show which pages a workload touches.

A GitHub Enterprise Server security fix addresses a way to turn the appliance's notebook viewer into a route to its own internal services.

Seccomp limits which Linux system calls a process can make.

Privilege escalation in a container does not always begin with a new exploit.

Linux containers can be paused, checkpointed, and rebuilt later with CRIU.

A container normally starts under the security rules of the system receiving it.

Kubernetes groups one or more containers into a pod, the basic unit it deploys.

A live Linux distribution runs from removable media, usually a USB drive, without requiring a permanent installation.

CISA has added CVE-2025-39964, a flaw in the Linux kernel’s built-in cryptography interface, to its list of vulnerabilities being used in real attacks.

Security researchers have shown how hidden instructions in an AWS AgentCore support ticket could push an AI agent into running commands as root and exposing a service credential.

The crun container runtime has changed how GPU-enabled workloads launch a key graphics helper.

Linux developers have fixed two memory-safety bugs in the subsystem that lets hardware move data without constant help from the CPU.