Loading story…
Upstream Linux kernel maintainers patched three vulnerabilities reported by researchers, including two NULL pointer dereferences reachable by unprivileged users and a long-standing Btrfs memory corruption issue. CVE-2025-40072 affects fanotify mount-namespace monitoring introduced in Linux 6.16, where do_fanotify_mark() dereferenced the return value of mnt_ns_from_dentry() without verifying it was non-NULL, allowing a kernel crash and denial of service; the fix landed in 6.17.3 and 6.18-rc1. CVE-2025-39950 affects the TCP stack when TCP-AO is combined with TCP_REPAIR, causing tcp_ao_finish_connect() to dereference a NULL skb during connect() and crash the kernel.
A third fix, CVE-2025-40205, addresses a potential 8-byte out-of-bounds write in Btrfs btrfs_encode_fh() that could occur when parent and inode root IDs differ and the function reports a smaller buffer requirement than it later writes. Kernel discussions said the flaw had effectively persisted for about 17 years, with an earlier latent memory-corruption concern in the same area dating back to 2010; the final patch corrected size calculations, added bounds validation, and was marked for stable kernels back to 3.0+. Researchers said the Btrfs issue may be difficult to trigger in practice, but all three bugs were fixed upstream and highlighted as kernel stability and memory-safety risks.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
A Linux kernel CVE announcement assigned CVE-2025-40205 to the Btrfs btrfs_encode_fh() out-of-bounds write issue and documented fixes across stable branches, including 5.4.301, 5.10.246, 5.15.195, 6.1.157, 6.6.113, 6.12.54, 6.17.4, and 6.18-rc1. The advisory recommended updating to the latest stable kernel rather than cherry-picking individual commits.
A Linux kernel CVE announcement assigned CVE-2025-40072 to the fanotify NULL dereference issue and documented that it was fixed in Linux 6.17.3 and 6.18-rc1. The advisory recommended updating to the latest stable kernel rather than cherry-picking individual commits.
Allele Security published details on three Linux kernel vulnerabilities it reported: fanotify NULL dereference CVE-2025-40072, TCP NULL dereference CVE-2025-39950, and a potential Btrfs out-of-bounds write CVE-2025-40205. The post said all three fixes had already been merged upstream.
David Sterba committed a Linux kernel patch fixing a potential 8-byte out-of-bounds write in Btrfs btrfs_encode_fh() by correcting size calculations and validating *max_len before writing. The commit marked the fix for stable kernels back to 3.0+.
Jakub Kicinski committed a Linux kernel fix for a NULL pointer dereference in tcp_ao_finish_connect() when TCP-AO is used with TCP_REPAIR during connect(). The patch adds a NULL check for skb before accessing tcp_hdr(skb)->seq.
A Linux kernel commit added a NULL check in do_fanotify_mark() before dereferencing the result of mnt_ns_from_dentry(), preventing crashes in the FSNOTIFY_OBJ_TYPE_MNTNS path. This upstream fix is the change later associated with CVE-2025-40072.
Jan Beulich submitted a patch to fix a latent memory corruption issue in btrfs_encode_fh() in Btrfs, adding a bounds check before writing parent_root_objectid. The mailing-list post shows the issue was recognized as early as October 2010.
In a mailing-list reply, David Sterba acknowledged Anderson Nascimento's Btrfs out-of-bounds fix, said the bug appeared to be 17 years old, and noted the patch had not actually been queued as believed. He said he would add it back to the for-next branch.
The Linux kernel CVE announcement states the fanotify flaw later tracked as CVE-2025-40072 was introduced in Linux kernel 6.16 by commit 58f5fbeb367ff6f30a2448b2cad70f70b2de4b06. The bug stems from dereferencing the return value of mnt_ns_from_dentry() without checking for NULL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
11 references tracked. Mallory keeps watching after this page renders.
kernel.org
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceallelesecurity.com
Open sourcelore.kernel.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026
Microsoft published a batch of Security Update Guide entries for Linux kernel vulnerabilities spanning core subsystems including `ext4`, `xfs`, memory management, networking, virtualization, and device drivers. The listed issues include memory-safety and stability flaws such as a use-after-free in `ext4` tracked as **CVE-2026-31446**, an `smc` double-free in **CVE-2026-31507**, a teardown-order use-after-free in the `spi-fsl-lpspi` driver in **CVE-2026-31485**, and a Bluetooth `L2CAP` bug in **CVE-2026-31498** that could trigger an infinite loop. Additional entries cover fixes in `af_key`, `netfilter` `ctnetlink`, `nfc` `nci`, `perf`, and memory-management code paths. The disclosures also include filesystem and virtual networking fixes such as **CVE-2026-31452** in `ext4`, **CVE-2026-31454** in `xfs`, and two `openvswitch` issues, **CVE-2026-31678** and **CVE-2026-31679`, addressing tunnel device release handling and MPLS payload-length validation. Microsoft further listed **CVE-2026-31601** in `vfio/xe` and **CVE-2026-31589** in the kernel MM subsystem, indicating broad exposure across Linux environments that rely on affected kernel components. The set of advisories points to patch activity focused on preventing use-after-free, double-free, locking, validation, and resource-lifecycle errors in widely deployed kernel code.
Jul 12, 2026