Loading story…
The Linux 7.2 merge window has introduced several security-focused changes, including support for updating Intel Trusted Domain Extensions (TDX) modules on running systems, a step aimed at improving maintainability for confidential-computing deployments without requiring downtime. The kernel also adds arm64 hardening to remove data regions from the linear map, strengthens openat2() with OPENAT2_REGULAR and EFTYPE handling, and extends fs-verity support in iomap alongside a new dm-inlinecrypt device-mapper target.
Additional protections target exploit resistance and attack-surface reduction across the kernel. The slab allocator now supports Clang allocation tokens to make cross-object memory corruption harder to exploit, while PowerPC’s hardware-optimized MD5 implementation is being removed and AF_ALG is being deprecated after multiple recent security issues, including removal of its hardware-accelerator support. The update also includes broader networking and BPF changes, but the most notable theme is a sustained push to harden core kernel subsystems and reduce exposure from legacy or problematic components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Linux 7.2 merge window began with the release of Linux 7.1. This marked the start of merging changes later summarized as part of the 7.2 development cycle.
During the 7.2 merge window, the kernel gained security-relevant changes including live replacement support for Intel TDX modules, openat2() hardening via OPENAT2_REGULAR and EFTYPE, slab allocator support for Clang allocation tokens, AF_ALG deprecation and hardware-accelerator removal, PowerPC MD5 implementation removal, and fs-verity support in iomap. The arm64 linear-map hardening work was also merged and then temporarily reverted because of a KVM regression.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux **7.2** has been released with a broad set of platform, performance, filesystem, networking, virtualization, and driver updates, including Cache Aware Scheduling, `USB4STREAM`, AMDGPU HDMI 2.1 FRL support, storage improvements across XFS, Btrfs, Ext4, F2FS, NFS, SMB, NTFS, Ceph, and Device Mapper, and security-relevant additions such as Intel TDX support, KVM support for Intel MBEC and AMD GMET, Landlock enhancements, IMA updates, and TCP-AO support without a `libcrypto` dependency. The release also brings reported I/O gains on AMD and Intel systems, faster poll performance, graphics improvements for Intel Arc and other GPU stacks, and continued Rust-for-Linux progress. The final release incorporated several late fixes and reverts, including a new `tlbi=` boot parameter added through an x86 urgent pull request. The currently supported setting, `tlbi=ipi`, restores older IPI-based TLB flushing as a debugging and mitigation aid after recently discovered `INVLPGB` and `TLBSYNC` issues on AMD CPUs were suspected of contributing to user-space crashes when broadcast TLB flushing is used. Kernel developers also reverted the newer DRM fair scheduler after regressions, and the `tlbi=ipi` change is slated for backporting to stable kernel branches.
Aug 20, 2026
OpenBSD released multiple **7.9 kernel errata** addressing security and stability flaws across System V IPC, NFS, ELF execution, and IPsec/IPComp handling. The updates include **errata 004, 005, 006, and 007**, with fixes for information leaks, kernel crash conditions, locking failures, race conditions, memory leaks, double-free scenarios, and unsafe object lifetime handling. In the ELF subsystem, the patch hardens note parsing, prevents invalid loader states, improves cleanup on exec failure paths, and fixes issues involving `pinsyscall(8)` and `kbind(8)`. The SysV IPC fixes harden semaphore, message queue, and shared-memory system calls by adding semaphore reference counting, correcting structure exposure through `sysctl`, fixing wakeup and receive races, and enforcing safer bounds and allocation behavior, including `MSG_NOERROR` and `sys_shmat()` handling. Separate patches repair NFS server request parsing and vnode reference handling to prevent double-free and memory-management bugs, while IPsec/IPComp changes add stricter packet validation and bounds checks in `cryptosoft.c`, `ip_ah.c`, and `ipsec_input.c` to stop kernel crashes. OpenBSD distributed the fixes as signed patches and indicated administrators should apply them through the normal patching process, including kernel rebuilds or supported binary updates.
Jul 16, 2026
Intel issued a broad security update spanning **42 advisories** and **72 vulnerabilities** across processors, firmware, management components, drivers, and software, while a related CPU microcode release fixed **eight processor security issues** affecting product lines including **Xeon 6**, **Core Ultra**, **3rd Gen Xeon Scalable**, and **10th Gen and newer Intel Core** chips. Reported impacts include **escalation of privilege**, **information disclosure**, **denial of service**, and **local code execution**, with several flaws tied to **Intel TDX**, transient execution behavior, firmware control flow, and hardware logic race conditions. The microcode package also added first-time support updates for **Bartlett Lake** and **Wildcat Lake**, alongside non-security functional fixes. Intel's Security Center advisory catalog shows the vendor's updates cover a wide range of platforms, including graphics, wireless, Ethernet, UEFI and server firmware, and developer software such as **oneAPI**, **OpenVINO**, and **Gaudi**, underscoring that the release was part of a larger coordinated remediation effort across Intel's hardware and software ecosystem.
Aug 13, 2026