LinuxSecurity.com

Virtualizor has confirmed that a BGP hijack redirected traffic for part of its update infrastructure and allowed an attacker-controlled server to deliver a malicious update package to a small number of installations. The company disclosed the incident on August 31, 2026, after the routing diversion ran across two periods between August 28 and August 30.

A Linux host intrusion prevention system can fail even when the protected server still has spare CPU. If its logging path cannot record and move events as quickly as an attacker creates them, the control loses the evidence it needs to block the source.

A Linux kernel patch series submitted on Sep 1, 2026, stops an out-of-service Logical Link Control socket from indexing below two connection-state tables. The bug produced Kernel Address Sanitizer and Undefined Behavior Sanitizer reports for a global out-of-bounds read.

A Linux server can be carefully hardened before it reaches production and still become less secure over time. Hardening means reducing unnecessary services, accounts, permissions, and other ways into the system. That work matters, but it describes the server at one point in time. Six months later, a new application may be installed, a firewall port opened for troubleshooting, an administrator given sudo access to run commands with elevated privileges, or a software update may have changed a c...

A patched Linux server can still fail a penetration test because patch status cannot show whether an attack path remains open.

Using a proxy on Linux changes how web traffic reaches its destination, but it does not automatically protect every part of the connection. DNS requests may still leave through the system’s normal resolver, while proxy usernames and passwords can remain exposed in scripts or local files.

A version 2 Linux kernel patch posted on August 31 fixes a stack overflow in the SA2UL hardware crypto driver. The Kernel Address Sanitizer, or KASAN, detected a one-byte write past a local buffer while strongSwan’s charon-systemd process was configuring an IPsec transform.

RxRPC is a Linux kernel transport for remote procedure calls. A teardown race reported in August shows that its network namespace cleanup can still reach a peer after that peer has been freed. The failure was caught by the Kernel Address Sanitizer, or KASAN, during automated testing.

A version 2 Linux kernel patch series posted on August 31 proposes a new eBPF security interface for applying Landlock policy during program execution. The 15-patch set introduces generic Linux Security Module policy objects, lets privileged BPF programs retain those objects in maps, and adds a helper that can apply a selected policy during exec processing.

An eBPF security system can produce precise Linux telemetry while leaving a harder question unanswered: what happens if the eBPF layer itself is misconfigured, vulnerable, or trusted too broadly?

Linux interrupt maintainer Thomas Gleixner traced a Kernel Address Sanitizer report to incomplete regmap IRQ cleanup on Aug 30, 2026. The crash appeared while Linux was taking a CPU offline, but the stale pointer was created earlier when a device’s interrupt setup failed.

Jonghyuk Kim submitted a Linux Direct Rendering Manager scheduler patch series on Aug 28, 2026 that targets a use-after-free read shared by several GPU drivers. The proposed change caches a fence’s timeline name while its scheduler is still alive.

A Kubernetes workload can run with more Linux capabilities than its code needs. When capability settings are missing or broad, that excess authority may remain invisible because the application still works.

Removing a Linux trace instance should end its lifetime. An open tracefs reader can currently keep using that instance after another task removes it, creating a kernel use-after-free path in the tracing subsystem.

A Linux service may need broad system-call access while it starts, then only a smaller set while it handles requests. A single policy loaded before startup often has to keep every required call available for the service's entire lifetime.