Loading story…
Amazon has released a preview of Amazon Linux 2027 (AL2027) for AWS cloud infrastructure and Amazon EC2. Available for x86_64 and ARM64/Aarch64—including AWS Graviton—the distribution draws on Fedora Linux 44 and 45 components and includes an AWS-oriented kernel with Elastic Network Adapter (ENA), Elastic Fabric Adapter (EFA), EC2-service integration, and live kernel patching.
AL2027 strengthens default platform security by enabling SELinux in enforcing mode and enabling post-quantum ML-DSA and SLH-DSA signatures by default across OpenSSH, OpenSSL, GnuTLS, and NSS. The release also moves to RPM 6.0 and DNF5 and refreshes major components including GCC, LLVM, OpenSSL, glibc, systemd, and Python.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Amazon announced a preview of Amazon Linux 2027 (AL2027) for AWS cloud infrastructure and Amazon EC2. The distribution supports x86_64 and ARM64/Aarch64, is built from Fedora 44 and 45 components, and strengthens defaults with enforcing SELinux and post-quantum ML-DSA and SLH-DSA signatures in major cryptographic components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
phoronix.com
Open sourceopennet.me
Open sourceopennet.ru
Open sourceaws.amazon.com
Open sourceaws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories for the Linux kernel in **Red Hat Enterprise Linux 9.6** channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to **reboot systems after installation**. The newer advisory, **RHSA-2026:34094**, updates the kernel to `5.14.0-570.125.1.el9_6` across `x86_64`, `aarch64`, `ppc64le`, and `s390x`, and addresses **18 CVEs** spanning subsystems such as **netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP,** and process exit handling. An earlier advisory, **RHSA-2026:14339**, also targeted RHEL 9.6 kernel packages and listed impacts including **denial of service, memory corruption, privilege escalation,** and **use-after-free** flaws in components including **nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead,** and **CAN raw**. One of the patched issues, **CVE-2025-68741**, affects the Linux kernel's **qla2xxx SCSI driver** and stems from improper freeing of a `purex` item in `qla2xxx_process_purls_iocb()`. Red Hat and Bugzilla records say the flaw occurs when memory obtained from `qla24xx_alloc_purex_item()` is incorrectly released with `kfree()` instead of `qla24xx_free_purex_item()`, creating a **CWE-763** invalid pointer release condition that can cause **memory corruption**. Red Hat rated the issue **Moderate** for its products, noted that fixes were shipped across multiple **RHEL 8, 9, and 10** kernel packages, and said **RHEL 6** is not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 28, 2026
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026