CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation(penligent.ai)

52 points by cobychapple 14 days ago | 32 comments

A Penligent blog post analyzing CVE-2026-98432, a Linux kernel IPv4 TCP handshake use-after-free, its severity scores, exploitation evidence, and how to validate patches.

Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more(broccoli2shell.com)

384 points by theanonymousone 20 days ago | 200 comments

Aikido blog post explaining CVE-2026-111497, a critical Brotli decoder out-of-bounds write affecting Node.js, Python, and HTTP libraries, with patch versions and workarounds.

Linux gives up on 6-year LTS kernels, says they’re too much work(arstechnica.com)

220 points by rascul 3 years ago | 154 comments

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8(atlasum.net)

688 points by oger 13 days ago | 323 comments

Atlas Security advisory on CVE-2026-98432, a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, covering affected versions, distro status, checks, and mitigations.

OpenSSH 10.6(openssh.org)

97 points by torcete 1 month ago | 23 comments

Release notes for OpenSSH 10.6, noting many AI-assisted security bug reports, more frequent releases, and an upcoming deprecation of scp's -R flag.

Proxmox Virtual Environment 9.0 with Debian 13 released(proxmox.com)

128 points by speckx 1 year ago | 51 comments

New Linux udisks flaw lets attackers get root on major Linux distros(bleepingcomputer.com)

336 points by smig0 1 year ago | 227 comments

BleepingComputer news article about a udisks vulnerability that lets attackers gain root privileges on major Linux distributions.

My first contribution to Linux(vkoskiv.com)

633 points by vkoskiv 1 year ago | 76 comments

A blog post recounting the author's experience upstreaming their first Linux kernel patch, fixing a hardware issue on a 2005 Fujitsu Lifebook S2110.

PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)(aws.amazon.com)

110 points by hayd 23 days ago | 26 comments

GitHub issue requesting Amazon Linux 2023 ship patched PHP packages for critical CVEs, with users asking AWS for a release timeline.

The Ubuntu 26.04 Rust sudo is not compatible with standard sudo(utcc.utoronto.ca)

139 points by wondersky 10 days ago | 122 comments

Blog post by Chris Siebenmann on how Ubuntu 26.04's Rust-based sudo (sudo-rs) differs from standard sudo; the page served a 429 rate-limit error.

Several Linux kernel vulnerabilities accidentally posted to public mailing list(phoronix.com)

223 points by mrkn1 22 days ago | 89 comments

Phoronix news article reporting that Trend Micro's Zero Day Initiative accidentally posted several unpatched Linux kernel vulnerability reports to the public LKML.

Several vulnerabilities have been discovered in the Linux kernel(lwn.net)

529 points by luispa 1 month ago | 380 comments

LWN.net repost of Debian Security Advisory DSA-6528-1, a Linux kernel security update fixing numerous CVEs, dated September 29, 2026.