LinuxSecurity.com

A new arm64 Kernel-based Virtual Machine (KVM) merge tightens two ordinary-looking mechanisms with major security weight: page mappings for protected-hypervisor stacks and the lifetime of memory-management state used by nested virtual machines.

Manufacturing security tends to fail at the seam between information technology and operational technology. 

A Linux io_uring race can let a polling thread release ring state while the CPU that published the work is still using it.

Linux is not a standard environment. An enterprise can run many different flavors of Linux on its servers, desktops and specialized systems, each with its own set of software packages, dependencies and updates.

Corrupted ext4 metadata can direct a Linux kernel copy past the inode region that is supposed to contain inline data.

A Linux USB/IP timer can restart after device teardown has begun, leaving the kernel callback able to use a virtual controller that has already been freed.

A Linux ext4 race can corrupt a directory while the filesystem converts it from inline storage to a regular block.

A Linux eBPF security race can leave generated kernel code pointing at a BPF program after that program’s memory has been released.