Loading story…
Google's security research team implemented and merged mitigation updates for several Linux kernel vulnerabilities as part of the kernelCTF project. These updates address CVE-2025-37756, CVE-2024-58239, and CVE-2025-38616, with dedicated mitigation directories and commits for each CVE. The mitigations were contributed and merged into the security-research repository, reflecting ongoing efforts to secure kernel environments against newly discovered threats. The updates include specific changes and documentation for each vulnerability, ensuring that the kernelCTF project remains current with the latest security requirements.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A subsequent pull request added kernelCTF LTS material for CVE-2025-38502 in the Google Security Research repository. This appears to be a new technical update for handling the vulnerability in long-term support kernels.
A Google Security Research pull request was opened to add a kernelCTF mitigation for CVE-2024-26824. This represents publication of mitigation-related material for the vulnerability.
A kernelCTF mitigation for CVE-2025-37756 was added via a Google Security Research pull request. The repository update marks a new technical disclosure related to mitigating the flaw.
A pull request was opened to add a kernelCTF mitigation for CVE-2025-38616, specifically referencing LTS/COS. The change reflects publication of mitigation guidance or code for this kernel issue.
A Google Security Research pull request was opened to add a kernelCTF mitigation for CVE-2024-58239. This indicates technical mitigation material for the kernel vulnerability was prepared or published in the repository.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google's `security-research` repository received kernelCTF-related pull requests tied to Linux kernel vulnerabilities including `CVE-2024-26582`, `CVE-2026-23209`, and a reference to `CVE-2026-23392`. The updates were submitted through GitHub pull requests and include repeated revisions to mitigation material, writeups, and proof-of-concept content, with commit history showing iterative changes such as "final," "update writeup," and "update pocs." One pull request associated with `CVE-2026-23209` also references files named `original.tar.gz` and `exploit.md`, indicating publication of source material and exploit documentation in the repository. The available records do not provide technical specifics on exploitation, affected distributions, or patch guidance, but they show active disclosure and documentation work around kernelCTF targets in Google's public research repository. For defenders, the appearance of exploit notes and PoC-related updates in a widely watched security-research project is a signal to track the cited CVEs closely, validate kernel exposure, and review vendor advisories and mitigation status for impacted Linux environments.
Jun 29, 2026
A new submission tied to **CVE-2026-53362** was added to Google's `security-research` repository through a `kernelCTF` pull request opened by researcher **qwerty-po**. The pull request proposes merging a branch named `cve-2026-53362` into `master` and adds **3,525 lines across 31 files**, indicating a substantial package of material rather than a minor documentation update. A corresponding fork and branch maintained by the same researcher shows that **default documentation and an exploit** were prepared for the CVE, suggesting public proof-of-concept material is being staged for inclusion in the repository. The visible references do not disclose the affected kernel component, exploitation details, or impact, but the submission indicates that exploit code associated with `CVE-2026-53362` has been prepared and is awaiting normal repository review steps, including contributor license verification.
Jul 22, 2026
Red Hat released updated Linux kernel and `kernel-rt` packages for affected RHEL 7, 8, and 9 streams to address Intel processor MMIO stale-data vulnerabilities: `CVE-2022-21123` (SBDR), `CVE-2022-21125` (SBDS), and `CVE-2022-21166` (DRPW). The flaws stem from incomplete cleanup of shared buffers, fill buffers, and special-register write resources, potentially exposing stale processor data. Updates cover standard RHEL releases as well as EUS, AUS, TUS, SAP, telecommunications, and mission-critical offerings across supported architectures. Several advisories also remediate `CVE-2022-2588`, a `cls_route` use-after-free that could enable local privilege escalation, alongside other kernel flaws; separate RHEL updates address `CVE-2022-1158` in KVM and `CVE-2022-2639`, an Open vSwitch out-of-bounds write. Organizations should install the applicable updated kernel packages, reboot systems to activate the fixes, and update or rebuild affected Red Hat OpenStack Platform 17.0 container images where applicable.
Aug 26, 2026