Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
23 / 23 results
criticalbug_reportVulnerabilityTwo 9.0 CVSS RCE flaws in Linux KSMBD disclosed before kernel fixes
Linux KSMBD (kernel SMB server) on all distributions where the module is loaded. ZDI-CAN-33774 affects any KSMBD install on port 445. ZDI-CAN-33549 requires SMB Direct transport with RDMA-capable network hardware or rxe software driver.
highperson_alertThreat ActorAI-Powered Campaign Targets Government Linux Systems
CL-UNK-1211 is a cluster of activity tracked by Unit 42 whose affiliation with nation-state or cybercrime actors has not yet been determined. Active from October 2025 through April 2026, the campaign targeted government entities and state-affiliated…
criticalbug_reportVulnerabilityLinux kernel flaw CVE-2026-99999 lets guest VMs read host memory
Linux kernel networking code across all major cloud providers using kernel-based virtualization. Fixed in stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57, 7.2.11.
highbug_reportVulnerabilityUbuntu unpatched for Linux kernel container escape (CVE-2026-80521)
Linux kernel versions 6.10+ (including stable branches 6.1 and 6.6). Ubuntu 26.04, 24.04 LTS, and 22.04 LTS remain unpatched. Affects AWS, Azure, and GCP kernel packages. Fixed upstream in kernel 7.2 and 7.1.10 on August 6, 2026.
criticalbug_reportVulnerabilityLinux ARM64 KVM flaw allows guest-to-host escape via nested virtualization
Linux kernel ARM64 KVM code with nested virtualization enabled. Affected versions: 6.17 through 6.18.50, 7.0 through 7.2.4, and 7.3-rc pre-releases. Fixed in 6.18.51, 7.2.5, and 7.3-rc1.
criticalbug_reportVulnerabilityThree Linux kernel flaws under active exploitation, CISA orders patching
Linux kernel across distributions. CVE-2025-39964 (critical, 14-year-old race condition in AF_ALG cryptographic socket interface), CVE-2026-53266 (out-of-bounds write in ebtables SNAT), CVE-2025-39682 (TLS receive-path logic flaw with kTLS).
criticalbug_reportVulnerabilityCISA: Three Linux kernel CVEs actively exploited in the wild
Linux kernel across all distributions. CVE-2025-39682 affects TLS receive path (CVSS 9.8), CVE-2026-53266 affects ebtables SNAT/ARP (CVSS 8.8), CVE-2025-39964 affects AF_ALG socket handling (CVSS 7.8). All require local authenticated access.
highbug_reportVulnerabilityFour Linux kernel local root exploits released with public PoC code
Linux kernel versions prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4. Four vulnerabilities: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), CVE-2026-74469 (DiagSpill).
criticalbug_reportVulnerability18-year-old Linux SCTP flaw enables local root and container escape
Linux kernel versions since 2.6.25 (2008) through 7.1.5, 6.18.41, 6.12.100, and 6.6.147. Affects systems with SCTP networking enabled. Confirmed vulnerable: Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, OpenCloudOS.
highbug_reportVulnerabilityZapscape KVM flaw allows L1 guest escape to host with nested virtualization
Linux kernel KVM/x86 shadow MMU in versions 5.9 through 7.1.5. Fixed in stable releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Affects systems running KVM hosts with nested virtualization exposed to untrusted guests.
highbug_reportVulnerabilityLinux kernel Open vSwitch flaw grants local root; public exploit available
Linux kernel Open vSwitch datapath. Fixed in stable kernels 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. Affects default configurations of AlmaLinux 9/10, Alpine 3.22-3.24, Amazon Linux 2023, Arch, CentOS Stream 9/10, Debian 12/13, Fedora…
highbug_reportVulnerabilityTengu botnet abuses Linux watchdog to force reboots after process kill
Linux-based IoT devices and embedded systems across multiple architectures (i386, amd64, MIPS, ARM, PowerPC, m68k). No specific vendor or device model identified. Devices with exposed Telnet services and weak credentials are primary targets.
highbug_reportVulnerabilityLinux kernel use-after-free in traffic-control allows local root escalation
Linux kernel versions 4.14 through 7.0.x. Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, and mainline 7.1-rc7. CentOS Stream 9 exploit demonstrated.
highbug_reportVulnerabilityLinux XFS race condition CVE-2026-64600 enables local root escalation
Linux kernel v4.11 and later (since February 2017) with XFS filesystem and reflink enabled (default on RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux).
criticalbug_reportVulnerability15-year-old Linux kernel flaw allows local privilege escalation to root
Linux kernel versions since 2011 across all mainstream distributions (Ubuntu, RHEL, Debian, SUSE, etc.). Any system running an unpatched kernel containing CVE-2026-43499 is vulnerable. Requires local authenticated access to exploit.
highbug_reportVulnerability16-year-old Linux kernel flaw enables VM escape on Intel and AMD hosts
Linux kernel (specific versions not disclosed); affects virtualization environments on Intel and AMD processors. VM escape vulnerability impacts hypervisors relying on affected kernel versions.
criticalbug_reportVulnerability16-year KVM hypervisor flaw enables guest-to-host kernel corruption
Linux KVM hypervisor on Intel and AMD x86 systems. All Linux kernel versions containing the vulnerable shadow MMU code (approximately 16 years of releases).
criticalbug_reportVulnerabilityLinux kernel "Bad Epoll" flaw grants unprivileged root access
Linux kernel (version range not specified) on desktops, servers, and Android devices. Affects both traditional Linux distributions and Android-based systems. Exploitable by unprivileged local users.
criticalbug_reportVulnerabilityLinux kernel traffic-control flaw grants local root via public exploit
Linux kernel traffic-control subsystem (act_pedit module). All distributions running vulnerable kernel versions are affected. Specific patched versions not provided; assume unpatched kernels prior to June 16, 2026 vendor advisories are vulnerable.
highbug_reportVulnerabilityDirtyClone Linux kernel flaw enables local privilege escalation to root
Linux kernel (specific vulnerable versions not disclosed). Affects systems where local users can trigger network packet cloning operations. Part of the DirtyFrag vulnerability family.
criticalperson_alertThreat ActorVelvet Ant: China-linked APT backdoors Linux auth for decade-long access
Velvet Ant (G1047) is a China-linked advanced persistent threat actor characterized by exceptional operational security and long-term persistence capabilities.
criticalbug_reportVulnerabilityLinux kernel nf_tables use-after-free enables root escalation (CVE-2026-23111)
Linux kernel nf_tables subsystem. All distributions using vulnerable kernel versions prior to the February 5, 2026 patch. Affects systems where unprivileged users have local access or container environments.
highbug_reportVulnerabilityCIFSwitch: Linux kernel CIFS flaw enables local privilege escalation
Linux kernel CIFS implementation across multiple distributions. Specific affected kernel versions not yet disclosed. Requires local access to exploit.