Loading story…
Linux 7.2 has been released with a broad set of platform, performance, filesystem, networking, virtualization, and driver updates, including Cache Aware Scheduling, USB4STREAM, AMDGPU HDMI 2.1 FRL support, storage improvements across XFS, Btrfs, Ext4, F2FS, NFS, SMB, NTFS, Ceph, and Device Mapper, and security-relevant additions such as Intel TDX support, KVM support for Intel MBEC and AMD GMET, Landlock enhancements, IMA updates, and TCP-AO support without a libcrypto dependency. The release also brings reported I/O gains on AMD and Intel systems, faster poll performance, graphics improvements for Intel Arc and other GPU stacks, and continued Rust-for-Linux progress.
The final release incorporated several late fixes and reverts, including a new tlbi= boot parameter added through an x86 urgent pull request. The currently supported setting, tlbi=ipi, restores older IPI-based TLB flushing as a debugging and mitigation aid after recently discovered INVLPGB and TLBSYNC issues on AMD CPUs were suspected of contributing to user-space crashes when broadcast TLB flushing is used. Kernel developers also reverted the newer DRM fair scheduler after regressions, and the tlbi=ipi change is slated for backporting to stable kernel branches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Linus Torvalds announced the stable release of Linux 7.2 on 2026-08-16. The release included late fixes and reverts from the final week, including the tlbi=ipi boot option and a reversion to the DRM FIFO scheduler after regressions.
Igalia published a reference describing the Fair(er) DRM GPU scheduler, introducing the scheduler work that later became relevant to Linux 7.2's DRM scheduler reversion. This marks an earlier development in the DRM scheduling story.
Ahead of the Linux 7.2 release, a last-minute x86/urgent pull request was submitted to add the new tlbi= boot parameter. The option was introduced as a debugging aid for recently discovered INVLPGB and TLBSYNC issues on AMD CPUs and allows reverting to older IPI-based TLB flushing with tlbi=ipi.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourceopennet.me
Open sourceopennet.ru
Open sourcephoronix.com
Open sourcephoronix.com
Open sourcelore.kernel.org
Open sourcekernelnewbies.org
Open sourcelkml.org
Open sourceblogs.igalia.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux `7.2` merge window has introduced several security-focused changes, including support for updating Intel **Trusted Domain Extensions** (TDX) modules on running systems, a step aimed at improving maintainability for confidential-computing deployments without requiring downtime. The kernel also adds arm64 hardening to remove data regions from the linear map, strengthens `openat2()` with `OPENAT2_REGULAR` and `EFTYPE` handling, and extends `fs-verity` support in `iomap` alongside a new `dm-inlinecrypt` device-mapper target. Additional protections target exploit resistance and attack-surface reduction across the kernel. The slab allocator now supports Clang allocation tokens to make cross-object memory corruption harder to exploit, while PowerPC’s hardware-optimized `MD5` implementation is being removed and `AF_ALG` is being deprecated after multiple recent security issues, including removal of its hardware-accelerator support. The update also includes broader networking and BPF changes, but the most notable theme is a sustained push to harden core kernel subsystems and reduce exposure from legacy or problematic components.
Aug 17, 2026
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing **x86 page-fault handling** logic flaw and newly optimized **page-cache side-channel** techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 `do_page_fault()` path could leave **hardware interrupts** enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into **Linux 6.19** with plans to backport to stable branches. Separately, researchers from Graz University of Technology described significantly faster Linux **page cache attacks**, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only **CVE-2025-21691** has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated **GPU DDK** issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Jun 29, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026