Loading story…
Suspicious and unauthorized files were discovered in the kernel.org/pub/ area, raising concerns that content hosted on the Linux kernel infrastructure may have been tampered with or exposed through an unauthorized upload. Reports indicate the materials were identified on the public distribution server and that some of the affected files were subsequently removed or made unavailable while the incident was being reviewed.
The incident prompted references to an official notice and additional technical details, suggesting maintainers treated the discovery as a potential security compromise affecting distributed content rather than a routine hosting issue. While the available reporting does not fully recover the exact filenames, actor, or intrusion method, the event centered on the integrity of files served from kernel.org/pub/ and the risk that users could have accessed untrusted material from a trusted source.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Some of the files associated with the incident were later removed or became unavailable, and access to the relevant materials on kernel.org/pub/ was affected. This reflects a response action following discovery of the suspicious content.
Unauthorized or suspicious files were found in the kernel.org/pub/ area, raising concerns about possible compromise or tampering with hosted distribution content. The incident was referenced in an official notice according to the source summaries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT published two advisories, `2025-1332` and `2025-1527`, warning of **multiple vulnerabilities in the Linux kernel**. The notices indicate that separate sets of kernel flaws were significant enough to warrant dedicated advisories, underscoring continued security risk in one of the most widely deployed operating system components across servers, cloud infrastructure, appliances, and embedded systems. While no public synopsis was included in the referenced advisories, the alerts point organizations to review affected kernel versions, assess exposure across Linux-based assets, and apply vendor-provided updates or mitigations. Because kernel vulnerabilities can affect core system security boundaries and stability, unpatched systems may face elevated risk depending on the specific flaws and deployment context.
Jun 29, 2026
Google's `security-research` repository received kernelCTF-related pull requests tied to Linux kernel vulnerabilities including `CVE-2024-26582`, `CVE-2026-23209`, and a reference to `CVE-2026-23392`. The updates were submitted through GitHub pull requests and include repeated revisions to mitigation material, writeups, and proof-of-concept content, with commit history showing iterative changes such as "final," "update writeup," and "update pocs." One pull request associated with `CVE-2026-23209` also references files named `original.tar.gz` and `exploit.md`, indicating publication of source material and exploit documentation in the repository. The available records do not provide technical specifics on exploitation, affected distributions, or patch guidance, but they show active disclosure and documentation work around kernelCTF targets in Google's public research repository. For defenders, the appearance of exploit notes and PoC-related updates in a widely watched security-research project is a signal to track the cited CVEs closely, validate kernel exposure, and review vendor advisories and mitigation status for impacted Linux environments.
Jun 29, 2026
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Aug 25, 2026