LinuxSecurity.com

Adobe has released an emergency fix for a Magento vulnerability that attackers are already using against online stores. Someone exploiting the flaw can make an affected store run code without first signing in. Adobe confirmed the attacks on Sep 8, 2026, one day after releasing the urgent hotfix.

Linux kernel testing can miss a bug when it depends on two tasks reaching the same data in an unusual order. These independently running tasks are called threads. A race condition occurs when their timing changes whether the code works correctly, which can make a failure difficult to reproduce. Google Project Zero published MAccConc on Sep 8, 2026 as a prototype that changes the timing itself. Its name is short for Memory Access Concurrency. The tool traces selected Linux kernel memory access...

A new Linux privilege escalation exploit shows how a cleanup mistake in Reliable Datagram Sockets, or RDS, can give a local user root access, meaning administrator control of the machine. RDS is a Linux kernel networking subsystem designed for low-latency communication between machines and processes.

Listing network routes should tell administrators where traffic will go. An IPv6 security report instead shows Linux accessing a freed record used to keep track of that listing. A list of active readers still points to the record after cleanup releases it, so a later route change can reach invalid memory and crash the kernel.

Suppose an application setting has changed on a Linux server, but nobody remembers changing it. The application still works, and the usual health checks show no trouble. A record confirms that a file changed, yet says nothing about who changed it or why.

A Linux cgroup, or control group, limits how much memory a group of processes can use. Yet its counters can look normal while those processes cause the host kernel, the core of the operating system, to use memory that is not counted against their limit. A networking patch posted on Sep 7, 2026 shows one way this can happen with IPv6 multicast routing, which sends network traffic to a group of recipients. The test creates routing tables inside namespaces: separate views of user identities and ...

A program can keep a Linux file open even after the separate networking environment behind it has started shutting down. That environment is called a network namespace. A SUNRPC patch posted on Sep 7, 2026 describes that exact failure in the /proc/net/rpc/use-gss-proxy control used by Linux remote procedure call (RPC) servers, including Network File System (NFS), which lets computers access files over a network.

Linux can move a network packet's data in memory while some networking code still holds its old address. That saved address is called a pointer. A patch and maintainer discussion posted on Sep 7, 2026 describe how that mismatch can make an IPv6 Segment Routing eBPF action write to memory that Linux has already released. Segment Routing steers packets through specified network waypoints; eBPF lets small programs run inside the kernel to customize tasks such as packet handling.

Chrome release notes can be a blur of version numbers. This one deserves a closer look. In the Linux build published on September 3, 2026, Google fixed CVE-2026-85046 and disclosed that an exploit was already in use. The build number to look for is 152.0.7977.82.

A proposed patch fixes a bug in Open vSwitch, a virtual network switch with an in-kernel Linux packet-processing path. An ordering race can free a flow-table mask array while packet processing still reads it. The report includes a Kernel Address Sanitizer, or KASAN, trace, and the author says the crash reproduces in about one minute on a two-vCPU guest.

A reported race in OCFS2, a Linux clustered file system for shared storage, can trigger a use-after-free while administrators configure a heartbeat region. The failure occurs when concurrent writes reach the same configfs device attribute and both manipulate one region's slot-data allocation.

A proposed Linux repair addresses two timer bugs that can trigger use-after-free conditions while one program replaces itself with another through exec(). Both failures begin with the same unusual transition: a thread that is not the process leader becomes the new leader, and Linux exchanges thread identifiers while timer and signal state still reflects the old ownership layout.

Linux maintainers are testing a patch for a page-cache bug after KASAN reproduced a use-after-free in filemap_map_pages(). On Sep 3, 2026, Andrew Morton said he would update the changelog, add cc:stable, and queue the patch for testing while awaiting review.

Linux TCP permits a listening socket to be transformed into a different kind of socket. A reproduced memory race has led maintainers to question whether that flexibility is worth keeping.

Linux containers are efficient because they share the host kernel. That same design gives the host deep authority over container memory, mappings, and process state. If the host is compromised or untrusted, namespaces cannot keep workload secrets away from it.

Tails OS is changing the speed of its entire Linux distribution because one of its most security-sensitive applications is tied to the system image. Tails 7.12 is the first release on a new two-week cadence, following Firefox and Tor Browser.

The Linux security news from August 27 through September 3 brought serious fixes for remote access software, PostgreSQL, sandboxing tools, local system services, and software that processes untrusted files.

A newly confirmed Kestra vulnerability is being exploited in the wild. CISA added CVE-2026-49869 to its Known Exploited Vulnerabilities catalog on Sep 2, 2026, turning an already serious authentication bypass into a current incident-response concern.

A kernel crash tells defenders that something went wrong. It does not show whether an attacker can turn that failure into a useful capability, combine several capabilities, and reach a security goal. That gap is one of the hardest parts of Linux kernel exploit development.

Virtualizor has confirmed that a BGP hijack redirected traffic for part of its update infrastructure and allowed an attacker-controlled server to deliver a malicious update package to a small number of installations. The company disclosed the incident on August 31, 2026, after the routing diversion ran across two periods between August 28 and August 30.