LinuxSecurity.com

Suppose an application setting has changed on a Linux server, but nobody remembers changing it. The application still works, and the usual health checks show no trouble. A record confirms that a file changed, yet says nothing about who changed it or why.

A Linux cgroup, or control group, limits how much memory a group of processes can use. Yet its counters can look normal while those processes cause the host kernel, the core of the operating system, to use memory that is not counted against their limit. A networking patch posted on Sep 7, 2026 shows one way this can happen with IPv6 multicast routing, which sends network traffic to a group of recipients. The test creates routing tables inside namespaces: separate views of user identities and ...

A program can keep a Linux file open even after the separate networking environment behind it has started shutting down. That environment is called a network namespace. A SUNRPC patch posted on Sep 7, 2026 describes that exact failure in the /proc/net/rpc/use-gss-proxy control used by Linux remote procedure call (RPC) servers, including Network File System (NFS), which lets computers access files over a network.

Linux can move a network packet's data in memory while some networking code still holds its old address. That saved address is called a pointer. A patch and maintainer discussion posted on Sep 7, 2026 describe how that mismatch can make an IPv6 Segment Routing eBPF action write to memory that Linux has already released. Segment Routing steers packets through specified network waypoints; eBPF lets small programs run inside the kernel to customize tasks such as packet handling.

Chrome release notes can be a blur of version numbers. This one deserves a closer look. In the Linux build published on September 3, 2026, Google fixed CVE-2026-85046 and disclosed that an exploit was already in use. The build number to look for is 152.0.7977.82.

A proposed patch fixes a bug in Open vSwitch, a virtual network switch with an in-kernel Linux packet-processing path. An ordering race can free a flow-table mask array while packet processing still reads it. The report includes a Kernel Address Sanitizer, or KASAN, trace, and the author says the crash reproduces in about one minute on a two-vCPU guest.

A reported race in OCFS2, a Linux clustered file system for shared storage, can trigger a use-after-free while administrators configure a heartbeat region. The failure occurs when concurrent writes reach the same configfs device attribute and both manipulate one region's slot-data allocation.

A proposed Linux repair addresses two timer bugs that can trigger use-after-free conditions while one program replaces itself with another through exec(). Both failures begin with the same unusual transition: a thread that is not the process leader becomes the new leader, and Linux exchanges thread identifiers while timer and signal state still reflects the old ownership layout.

Linux maintainers are testing a patch for a page-cache bug after KASAN reproduced a use-after-free in filemap_map_pages(). On Sep 3, 2026, Andrew Morton said he would update the changelog, add cc:stable, and queue the patch for testing while awaiting review.

Linux TCP permits a listening socket to be transformed into a different kind of socket. A reproduced memory race has led maintainers to question whether that flexibility is worth keeping.

Linux containers are efficient because they share the host kernel. That same design gives the host deep authority over container memory, mappings, and process state. If the host is compromised or untrusted, namespaces cannot keep workload secrets away from it.

Tails OS is changing the speed of its entire Linux distribution because one of its most security-sensitive applications is tied to the system image. Tails 7.12 is the first release on a new two-week cadence, following Firefox and Tor Browser.

The Linux security news from August 27 through September 3 brought serious fixes for remote access software, PostgreSQL, sandboxing tools, local system services, and software that processes untrusted files.

A newly confirmed Kestra vulnerability is being exploited in the wild. CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, turning an already serious authentication bypass into a current incident-response concern.

A kernel crash tells defenders that something went wrong. It does not show whether an attacker can turn that failure into a useful capability, combine several capabilities, and reach a security goal. That gap is one of the hardest parts of Linux kernel exploit development.

Virtualizor has confirmed that a BGP hijack redirected traffic for part of its update infrastructure and allowed an attacker-controlled server to deliver a malicious update package to a small number of installations. The company disclosed the incident on August 31, 2026, after the routing diversion ran across two periods between August 28 and August 30.

A Linux host intrusion prevention system can fail even when the protected server still has spare CPU. If its logging path cannot record and move events as quickly as an attacker creates them, the control loses the evidence it needs to block the source.

A Linux kernel patch series submitted on Sep 1, 2026, stops an out-of-service Logical Link Control socket from indexing below two connection-state tables. The bug produced Kernel Address Sanitizer and Undefined Behavior Sanitizer reports for a global out-of-bounds read.

A Linux server can be carefully hardened before it reaches production and still become less secure over time. Hardening means reducing unnecessary services, accounts, permissions, and other ways into the system. That work matters, but it describes the server at one point in time. Six months later, a new application may be installed, a firewall port opened for troubleshooting, an administrator given sudo access to run commands with elevated privileges, or a software update may have changed a c...

A patched Linux server can still fail a penetration test because patch status cannot show whether an attack path remains open.