Loading story…
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing x86 page-fault handling logic flaw and newly optimized page-cache side-channel techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 do_page_fault() path could leave hardware interrupts enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into Linux 6.19 with plans to backport to stable branches.
Separately, researchers from Graz University of Technology described significantly faster Linux page cache attacks, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only CVE-2025-21691 has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated GPU DDK issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Linux kernel engineers implemented a single unconditional interrupt-disable step before returning to the low-level page-fault handler to correct the interrupt-state asymmetry issue. The remediation was merged into the Linux 6.19 branch, with plans to backport it to older stable releases.
Intel engineer Cedric Xing identified a long-standing Linux kernel x86 page-fault handling flaw caused by incorrect assumptions about interrupt state restoration in certain branches, including __bad_area_nosemaphore(). Kernel engineers concluded that branch-by-branch fixes were inadequate.
Researchers reported major efficiency gains in Linux page cache side-channel attacks, reducing page-cache flushing time from 149 milliseconds to 0.8 microseconds and completing attack loops in 0.6–2.3 microseconds. They also described techniques for inferring user actions, visited websites, file information in Docker contexts, and recovering sensitive data such as passwords through timing analysis.
The Linux kernel security team remediated CVE-2025-21691, one of the page cache–related issues discussed by researchers. The report notes this was the only issue in that set that had been fixed at the time of publication.
A flaw in Linux kernel x86 page-fault handling was introduced around the Linux 5.8 merge window in 2020, creating inconsistent interrupt-state handling across some fault paths. The bug could allow interrupts to be re-enabled when the kernel expected them to remain disabled.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026
Researchers disclosed the speculative-execution attacks **Meltdown** (`CVE-2017-5754`) and **Spectre** (`CVE-2017-5753`, `CVE-2017-5715`), showing that modern Intel, AMD, and ARM processors could leak sensitive data across privilege boundaries through cache-timing side channels. Google Project Zero demonstrated kernel and virtual-machine memory disclosure, while browser vendors including Mozilla confirmed that web content could abuse similar techniques, prompting Firefox to reduce timer precision and disable `SharedArrayBuffer` by default. Microsoft, Apple, Linux distributors, cloud providers, and hardware vendors issued operating-system, browser, and microcode mitigations, with Microsoft saying Azure had already been updated and Intel later announcing hardware changes for future chips. Early mitigation rollouts brought significant operational concerns, including uneven performance degradation and unstable firmware updates. Linux and macOS testing found that common desktop benchmarks often changed little, but syscall-heavy, storage, and IO-intensive workloads could slow noticeably, with some macOS microbenchmarks degrading by roughly **2x to 4x** and Windows Server or older systems expected to see larger impacts than newer Windows 10 devices. Intel’s early Spectre-related microcode updates were later linked to reboots and possible data corruption, leading Microsoft to publish an emergency update that disabled one mitigation path, while vendors such as Dell and NetApp tracked product exposure and remediation guidance as the industry continued responding to follow-on speculative-execution issues.
Aug 8, 2026
Researchers disclosed **CVE-2026-31431**, dubbed **CopyFail**, a Linux local privilege escalation flaw in the kernel crypto subsystem's `algif_aead`/`AF_ALG` AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit `72548b093ee3`, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts. Upstream fixed the issue by reverting `algif_aead` to out-of-place operation in Linux **7.0**, **6.19.12**, and **6.18.22**, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting `algif_aead`, blocking `AF_ALG` socket creation with seccomp or eBPF, or using the kernel boot parameter `initcall_blacklist=algif_aead_init` where the feature was built in. After public exploit code spread and additional exploit ports appeared, **CISA added the flaw to its Known Exploited Vulnerabilities catalog**, and defenders published detections focused on suspicious `AF_ALG`, `splice()`, and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.
Jul 23, 2026