LinuxSecurity.com

A newly reported Linux perf filter flaw lets an unprivileged user find where the kernel is loaded on a tested x86-64 configuration.

A newly reported Linux perf filter flaw lets an unprivileged user find where the kernel is loaded on a tested x86-64 configuration.

A Linux patch series addresses how file truncation or hole punching could discard valid data beyond the range an application asked to remove.

A proposed Linux tracing patch addresses a race that could free a function probe while its return callback is still using it.

A proposed Linux patch addresses a double unlock in the SuperH architecture’s page-fault handling.

A Linux security review can find a check, a lock, or a safe-looking range and still miss the failure.

Two critical GitLab flaws can turn authenticated continuous integration and delivery (CI/CD) configuration into code execution on self-managed servers.

crun has tightened the boundary between container-controlled configuration and host-controlled microVM behavior.

Two Linux fixes show how extended Berkeley Packet Filter (eBPF) security can fail when mutable map data crosses into the exec path, where Linux starts a program.

A Linux GPU security fix changes how AMD’s Kernel Fusion Driver (KFD) tracks shared mappings when several containers use one device.

runc 1.5.2 adds a workaround for a Linux cgroup v2 memory-corruption bug that can make the privileged container runtime crash unpredictably.

A new arm64 Kernel-based Virtual Machine (KVM) merge tightens two ordinary-looking mechanisms with major security weight: page mappings for protected-hypervisor stacks and the lifetime of memory-management state used by nested virtual machines.

Manufacturing security tends to fail at the seam between information technology and operational technology. 

A Linux io_uring race can let a polling thread release ring state while the CPU that published the work is still using it.

Linux is not a standard environment. An enterprise can run many different flavors of Linux on its servers, desktops and specialized systems, each with its own set of software packages, dependencies and updates.

Corrupted ext4 metadata can direct a Linux kernel copy past the inode region that is supposed to contain inline data.

A Linux USB/IP timer can restart after device teardown has begun, leaving the kernel callback able to use a virtual controller that has already been freed.

A Linux ext4 race can corrupt a directory while the filesystem converts it from inline storage to a regular block.

A Linux eBPF security race can leave generated kernel code pointing at a BPF program after that program’s memory has been released.

A cgroup namespace gives a Linux process a limited view of the control-group hierarchy that organizes workloads and accounts for resources.