Cybersecurity articles tagged #Linux Kernel on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cve-2026-53362-linux-kernel-ipv6-privilege-escalationhttps://runtimerebel.com/blog/cve-2026-53362-linux-kernel-ipv6-privilege-escalationCISA adds CVE-2026-53362 to KEV, confirming active exploitation of a Linux Kernel privilege escalation vulnerability via IPv6. Patch now.Tue, 01 Sep 2026 02:57:10 GMTCVE-2026-53362Linux KernelPrivilege EscalationIPv6CISA KEVhttps://runtimerebel.com/blog/cve-2026-53264-linux-traffic-control-bug-escalates-to-root-accesshttps://runtimerebel.com/blog/cve-2026-53264-linux-traffic-control-bug-escalates-to-root-accessA use-after-free race condition in the Linux kernel traffic-control subsystem, CVE-2026-53264, allows local privilege escalation to root on CentOS Stream 9.Tue, 28 Jul 2026 10:37:19 GMTCVE-2026-53264Linux KernelPrivilege EscalationSTAR LabsCentOS Stream 9https://runtimerebel.com/blog/multi-threat-brief-ai-malware-zimbra-exploits-linux-kernel-flawshttps://runtimerebel.com/blog/multi-threat-brief-ai-malware-zimbra-exploits-linux-kernel-flawsAnalysis of recent threats including DolphinX AI malware, state-sponsored Zimbra exploits, Siemens industrial switch vulnerabilities, and 400 Linux kernel flaws.Fri, 24 Jul 2026 17:42:24 GMTDolphinXEmerald SleetWinter VivernUNC4841ZimbraLinux KernelSiemens ROX IIIndustrial Control SystemsAPTRansomwareLockBithttps://runtimerebel.com/blog/cve-2026-64600-local-root-via-linux-xfs-race-condition-patch-nowhttps://runtimerebel.com/blog/cve-2026-64600-local-root-via-linux-xfs-race-condition-patch-nowA nine-year-old race condition in the Linux kernel XFS filesystem, known as RefluXFS, allows local attackers to achieve root privileges via file overwrites.Thu, 23 Jul 2026 14:07:00 GMTCVE-2026-64600Linux KernelXFSPrivilege EscalationRefluXFShttps://runtimerebel.com/blog/cve-2026-64600-refluxfs-race-condition-grants-root-on-rhel-systemshttps://runtimerebel.com/blog/cve-2026-64600-refluxfs-race-condition-grants-root-on-rhel-systemsTechnical analysis of CVE-2026-64600, a nine-year-old race condition in the Linux XFS driver allowing local privilege escalation on RHEL and Amazon Linux.Thu, 23 Jul 2026 10:24:28 GMTCVE-2026-64600RHELLinux KernelXFSPrivilege EscalationQualyshttps://runtimerebel.com/blog/cve-2026-43499-ghostlock-linux-kernel-privilege-escalation-analysishttps://runtimerebel.com/blog/cve-2026-43499-ghostlock-linux-kernel-privilege-escalation-analysisA 15-year-old Linux kernel flaw, CVE-2026-43499 (GhostLock), enables local root access and container escape across major distributions since 2011.Wed, 08 Jul 2026 06:29:58 GMTCVE-2026-43499Linux KernelPrivilege EscalationNebula Securityhttps://runtimerebel.com/blog/linux-kernel-januscape-flaw-vm-escape-on-kvm-hypervisorshttps://runtimerebel.com/blog/linux-kernel-januscape-flaw-vm-escape-on-kvm-hypervisorsAnalysis of the 16-year-old Januscape flaw affecting Linux KVM hypervisors, enabling VM escape and potential host code execution on Intel and AMD systems.Tue, 07 Jul 2026 11:10:21 GMTLinux KernelKVMVM EscapeJanuscapeVirtualization SecurityIntelAMDhttps://runtimerebel.com/blog/cve-2026-46242-linux-kernel-bad-epoll-flaw-grants-root-on-servers-androidhttps://runtimerebel.com/blog/cve-2026-46242-linux-kernel-bad-epoll-flaw-grants-root-on-servers-androidCritical Linux kernel 'Bad Epoll' flaw (CVE-2026-46242) allows unprivileged users to gain root access on servers, desktops, and Android devices. Patch now.Fri, 03 Jul 2026 21:09:03 GMTCVE-2026-46242Linux KernelPrivilege EscalationAndroidBad EpollLocal Roothttps://runtimerebel.com/blog/dirtyclone-linux-kernel-privilege-escalation-via-page-cache-manipulationhttps://runtimerebel.com/blog/dirtyclone-linux-kernel-privilege-escalation-via-page-cache-manipulationDirtyClone, a variant of DirtyFrag, allows unprivileged local users to exploit a Linux kernel flaw to manipulate the page cache and achieve root privileges.Mon, 29 Jun 2026 13:39:43 GMTDirtyCloneDirty FragLinux KernelPrivilege EscalationLocal Roothttps://runtimerebel.com/blog/cve-2026-46331-linux-pedit-cow-exploit-grants-root-accesshttps://runtimerebel.com/blog/cve-2026-46331-linux-pedit-cow-exploit-grants-root-accessA critical Linux kernel flaw, 'pedit COW' (CVE-2026-46331), allows local unprivileged users to gain root access via an out-of-bounds write. Public exploits exist.Fri, 26 Jun 2026 16:47:07 GMTCVE-2026-46331Linux KernelPedit COWPrivilege EscalationLocal Exploithttps://runtimerebel.com/blog/cve-2026-43503-linux-kernel-dirtyclone-flaw-grants-root-accesshttps://runtimerebel.com/blog/cve-2026-43503-linux-kernel-dirtyclone-flaw-grants-root-accessDirtyClone (CVE-2026-43503) is a Linux kernel privilege escalation allowing local users to gain root access via cloned network packets. Patch now.Fri, 26 Jun 2026 12:51:06 GMTCVE-2026-43503DirtyCloneLinux KernelPrivilege EscalationDirty Fraghttps://runtimerebel.com/blog/cve-2026-23111-linux-kernel-nf-tables-lpe-and-container-escapehttps://runtimerebel.com/blog/cve-2026-23111-linux-kernel-nf-tables-lpe-and-container-escapeA one-character use-after-free vulnerability in the Linux kernel nf_tables subsystem allows local root access and container escapes. Patch immediately.Mon, 08 Jun 2026 20:57:15 GMTCVE-2026-23111Linux KernelNf TablesPrivilege EscalationContainer Escapehttps://runtimerebel.com/blog/android-and-linux-kernel-exploitation-cve-2024-36971-and-cve-2024-21626https://runtimerebel.com/blog/android-and-linux-kernel-exploitation-cve-2024-36971-and-cve-2024-21626CISA adds Android CVE-2024-36971 and Linux CVE-2024-21626 to its KEV catalog following reports of active exploitation by sophisticated threat actors.Wed, 03 Jun 2026 17:46:16 GMTCVE-2024-36971CVE-2024-21626CISA KEVAndroid SecurityLinux KernelContainer Breakouthttps://runtimerebel.com/blog/cisa-kev-update-active-exploitation-of-cve-2022-0492-and-cve-2025-48595https://runtimerebel.com/blog/cisa-kev-update-active-exploitation-of-cve-2022-0492-and-cve-2025-48595CISA adds Linux Kernel and Android Framework vulnerabilities to its Known Exploited Vulnerabilities catalog. Prioritize patching CVE-2022-0492 and CVE-2025-48595.Tue, 02 Jun 2026 21:13:18 GMTCVE-2022-0492CVE-2025-48595CISA KEVLinux KernelAndroid Securityhttps://runtimerebel.com/blog/cve-2024-52336-how-cifswitch-grants-root-access-on-linux-systemshttps://runtimerebel.com/blog/cve-2024-52336-how-cifswitch-grants-root-access-on-linux-systemsThe CVE-2024-52336 vulnerability, known as CIFSwitch, allows local privilege escalation to root by abusing CIFS key requests in the Linux kernel.Sat, 30 May 2026 16:26:59 GMTCVE-2024-52336Linux KernelCIFSwitchQualysPrivilege Escalationhttps://runtimerebel.com/blog/cve-2026-46333-nine-year-old-linux-kernel-privilege-escalation-flawhttps://runtimerebel.com/blog/cve-2026-46333-nine-year-old-linux-kernel-privilege-escalation-flawA long-standing Linux kernel flaw, CVE-2026-46333, allows local users to achieve root access and disclose sensitive data on major Linux distributions.Thu, 21 May 2026 09:15:05 GMTCVE-2026-46333Linux KernelPrivilege EscalationLocal ExploitRoot Accesshttps://runtimerebel.com/blog/cve-2026-31635-dirtydecrypt-linux-kernel-lpe-poc-releasedhttps://runtimerebel.com/blog/cve-2026-31635-dirtydecrypt-linux-kernel-lpe-poc-releasedExploit code for DirtyDecrypt (CVE-2026-31635) has been released, allowing local privilege escalation via vulnerabilities in the Linux kernel crypto API.Tue, 19 May 2026 17:03:37 GMTCVE-2026-31635Linux KernelDirtydecryptPrivilege EscalationDirtyCBChttps://runtimerebel.com/blog/dirtydecrypt-how-attackers-exploit-linux-kernel-rxgk-for-root-accesshttps://runtimerebel.com/blog/dirtydecrypt-how-attackers-exploit-linux-kernel-rxgk-for-root-accessLearn about DirtyDecrypt, a local privilege escalation vulnerability in the Linux rxgk module. Discover how to detect and mitigate this root access threat.Mon, 18 May 2026 09:20:23 GMTLinux KernelRxgkPrivilege EscalationDirtydecryptExploit Pochttps://runtimerebel.com/blog/cve-2026-46300-fragnesia-flaw-enables-linux-root-privilege-escalationhttps://runtimerebel.com/blog/cve-2026-46300-fragnesia-flaw-enables-linux-root-privilege-escalationSecurity researchers identify Fragnesia (CVE-2026-46300), a Linux kernel vulnerability allowing local attackers to gain root access via packet fragmentation.Thu, 14 May 2026 20:37:48 GMTCVE-2026-46300Linux KernelFragnesiaPrivilege Escalationhttps://runtimerebel.com/blog/cve-2026-46300-linux-fragnesia-kernel-privilege-escalation-analysishttps://runtimerebel.com/blog/cve-2026-46300-linux-fragnesia-kernel-privilege-escalation-analysisCritical analysis of the Fragnesia Linux kernel vulnerability (CVE-2026-46300), enabling local root access via IP fragmentation flaws. Includes mitigation steps.Thu, 14 May 2026 09:04:30 GMTCVE-2026-46300Linux KernelFragnesiaPrivilege Escalationhttps://runtimerebel.com/blog/cve-2026-46300-fragnesia-linux-kernel-lpe-grants-root-accesshttps://runtimerebel.com/blog/cve-2026-46300-fragnesia-linux-kernel-lpe-grants-root-accessA technical analysis of CVE-2026-46300, a Linux kernel LPE vulnerability dubbed Fragnesia that enables root access via XFRM page cache corruption.Thu, 14 May 2026 09:03:13 GMTCVE-2026-46300Linux KernelFragnesiaLPEhttps://runtimerebel.com/blog/cve-2026-31431-analyzing-the-copy-fail-linux-kernel-lpehttps://runtimerebel.com/blog/cve-2026-31431-analyzing-the-copy-fail-linux-kernel-lpeTechnical analysis of CVE-2026-31431 (Copy.Fail), a critical Linux kernel vulnerability enabling local privilege escalation via page cache corruption.Tue, 12 May 2026 12:50:25 GMTCVE-2026-31431Linux KernelPrivilege EscalationTheorihttps://runtimerebel.com/blog/cve-2024-1086-dirty-frag-local-privilege-escalation-in-linux-kernelshttps://runtimerebel.com/blog/cve-2024-1086-dirty-frag-local-privilege-escalation-in-linux-kernelsAnalysis of CVE-2024-1086 (Dirty Frag), a netfilter vulnerability enabling local privilege escalation to root across major enterprise Linux distributions.Mon, 11 May 2026 17:02:08 GMTCVE-2024-1086Dirty FragLinux KernelPrivilege EscalationNetfilterhttps://runtimerebel.com/blog/cve-2026-43284-dirty-frag-linux-vulnerability-exploited-patch-nowhttps://runtimerebel.com/blog/cve-2026-43284-dirty-frag-linux-vulnerability-exploited-patch-nowAnalysis of the 'Dirty Frag' (Copy Fail 2) Linux kernel vulnerabilities CVE-2026-43284 and CVE-2026-43500, which enable potential remote code execution.Mon, 11 May 2026 09:18:43 GMTCVE-2026-43284CVE-2026-43500Linux KernelDirty FragZero-Dayhttps://runtimerebel.com/blog/dirty-frag-linux-kernel-lpe-unpatched-root-access-riskhttps://runtimerebel.com/blog/dirty-frag-linux-kernel-lpe-unpatched-root-access-riskAn unpatched Linux kernel vulnerability dubbed Dirty Frag allows local privilege escalation to root, building on the exploitation patterns of CVE-2026-31431.Fri, 08 May 2026 08:37:55 GMTLinux KernelDirty FragCVE-2026-31431Privilege EscalationRoot Accesshttps://runtimerebel.com/blog/cve-2024-1086-copy-fail-linux-privilege-escalation-under-exploitationhttps://runtimerebel.com/blog/cve-2024-1086-copy-fail-linux-privilege-escalation-under-exploitationCISA adds CVE-2024-1086 (Copy Fail) to its KEV catalog after Microsoft observes exploitation of this Linux Netfilter privilege escalation vulnerability.Mon, 04 May 2026 12:43:34 GMTCVE-2024-1086NetfilterLinux KernelCISA KEVPrivilege Escalationhttps://runtimerebel.com/blog/cve-2026-31431-linux-kernel-resource-transfer-vulnerability-actively-exploitedhttps://runtimerebel.com/blog/cve-2026-31431-linux-kernel-resource-transfer-vulnerability-actively-exploitedCISA adds CVE-2026-31431, a Linux Kernel incorrect resource transfer vulnerability, to its KEV catalog due to active exploitation. Prioritize remediation.Fri, 01 May 2026 20:24:29 GMTCVE-2026-31431Linux KernelResource TransferCISA KEVActive ExploitationBOD 22 01https://runtimerebel.com/blog/crackarmor-nine-linux-apparmor-flaws-enable-root-escalationhttps://runtimerebel.com/blog/crackarmor-nine-linux-apparmor-flaws-enable-root-escalationQualys researchers reveal nine CrackArmor vulnerabilities in the Linux AppArmor module, allowing unprivileged users to bypass container isolation and gain root.Fri, 13 Mar 2026 12:19:33 GMTLinux KernelAppArmorCrackArmorPrivilege EscalationContainer SecurityQualys