The U.S. Cybersecurity and Infrastructure Security Agency has added a Linux kernel vulnerability, tracked as CVE-2026-53362, to its Known Exploited Vulnerabilities catalog after confirming that attackers are exploiting the flaw in real-world attacks.

The issue affects the Linux kernel’s IPv6 networking subsystem. It could allow a local attacker to gain elevated privileges on a vulnerable system.

CVE-2026-53362 is currently described as an unspecified Linux kernel vulnerability. However, CISA said the flaw can enable privilege escalation through the IPv6 networking component.

Privilege escalation flaws are especially dangerous because an attacker with limited access to a Linux host may be able to obtain higher permissions, potentially including root-level control.

The vulnerability may affect Linux distributions and products that use the Linux kernel, including SUSE, Red Hat, and other vendor platforms.

Organizations should not assume that only these named distributions are affected, since the exposure depends on the kernel version, vendor build, configuration, and the availability of security fixes or mitigations.

Linux Kernel Privilege Escalation Vulnerability Exploited

CISA added CVE-2026-53362 to the catalog on August 27, 2026, and set a remediation deadline of August 30, 2026, for federal civilian executive branch agencies.

The agency has also marked the vulnerability as requiring forensic triage under Binding Operational Directive 26-04, indicating that affected organizations should assess whether exploitation has already occurred before or during patch application.

Although CISA has not linked the flaw to a specific ransomware operation, privilege-escalation vulnerabilities are often valuable to attackers once they have initial access.

A threat actor may exploit such weaknesses after gaining a foothold through stolen credentials, a vulnerable public-facing application, phishing, or a compromised cloud workload.

Elevated privileges can enable attackers to turn off security tools, access sensitive data, move laterally, and deploy ransomware across an environment.

CISA instructed organizations to apply mitigations in accordance with vendor guidance and to follow the risk-based security update requirements in BOD 26-04.

Where a vendor patch is unavailable, stakeholders should evaluate whether compensating controls can reduce exposure. CISA also stated that organizations should discontinue use of affected products if mitigations are not available.

Linux administrators should immediately identify internet-facing and business-critical systems running potentially affected kernel versions.

Security teams should review authentication activity, privilege changes, unexpected kernel-related errors, suspicious processes running as root, and endpoint detection alerts for signs of post-compromise activity.

Because details of exploitation remain limited, organizations should closely monitor updates from Linux distribution vendors and CISA.

The immediate priority is to determine which Linux assets rely on potentially affected kernels, apply vendor fixes, and conduct forensic triage on high-risk systems.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post CISA Warns of Linux Kernel Privilege Escalation Vulnerability Exploited in Attacks appeared first on Cyber Security News.

A Linux kernel vulnerability, tracked as CVE-2026-64561 and named Zapscape, could allow attackers to escape a KVM virtual machine and take control of its underlying Linux host with root privileges.

The issue affects KVM/x86, a virtualization technology that separates guest systems from the physical server. The flaw is especially serious for cloud providers and enterprises that run untrusted workloads.

Zapscape was discovered by security researcher Hyunwoo Kim, known as V4bel. It exists in KVM’s shadow memory management unit, or shadow MMU. It manages memory translations when nested virtualization is used.

Nested virtualization allows one virtual machine to run another virtual machine inside it. While useful for testing and cloud services, it creates a larger attack surface.

The vulnerability is a use-after-free bug in the recursive zap path used by KVM when reclaiming shadow pages. In simple terms, KVM can free a memory structure but later continue to use it.

Zapscape KVM Escape Grants Root Access

A malicious guest can trigger that unsafe condition from inside the guest. This can corrupt memory in the host kernel, breaking the security boundary that normally keeps a guest separate from its host.

A successful attack could have severe consequences. An attacker with kernel-level control in an L1 guest may execute commands on the KVM host as root.

That could allow data theft, service disruption, access to other virtual machines on the same server, or host control. In shared cloud environments, one compromised tenant instance could therefore put other customers at risk.

A proof-of-concept published on GitHub demonstrates the escape chain in a controlled QEMU TCG environment, resulting in a root-owned file on the host.

The researcher said it is not a ready-made cloud attack, but warned that adapting it to a real environment would not be difficult. Organizations should treat the availability of public exploits as an urgent patching signal.

The affected code was introduced in 2020 and was fixed upstream in Linux commit 2abd5287f083 on July 21, 2026. The patch changes the validation order in the shadow MMU fault path.

KVM now checks whether a root page became invalid after it makes MMU pages available. If the page was reclaimed, KVM retries the fault rather than continuing to use the invalid structure.

Risk is highest where nested virtualization is exposed to untrusted users. Guest root access is generally required for the documented escape route, which is common in infrastructure-as-a-service deployments.

Intel environments face an additional condition: both four-level and five-level EPT page-walk support must be exposed to the L1 guest. AMD systems do not have that stated condition.

Administrators should promptly install a vendor kernel containing the upstream fix and reboot affected KVM hosts. Until patching is complete, teams should disable nested virtualization for untrusted guests where operationally possible.

They should also restrict access to /dev/kvm, review host configurations, identify exposed multi-tenant systems, and monitor vendor advisories.

Zapscape shows that hypervisor patch management is essential: a single guest escape can undermine isolation across an entire server.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post CVE-2026-64561 Zapscape Lets KVM Guests Escape to Linux Host With Root Privileges appeared first on Cyber Security News.

A public proof-of-concept has been released for a use-after-free flaw affecting the Linux kernel’s bridge subsystem, specifically its Spanning Tree Protocol implementation in net/bridge.

The issue can leave STP timers active after the bridge network device that owns them has been deleted, creating a dangerous memory-safety condition in the kmalloc-cg-8k slab cache.

The use-after-free vulnerability occurs when kernel STP is enabled on an administratively down bridge and a bridge port transitions to the LEARNING state.

In this condition, the kernel can arm periodic STP timers without checking the IFF_UP interface flag. These timers support the STP state machine, which prevents Layer 2 loops by managing bridge-port states and network topology changes.

Linux stores timers such as hello_timer, tcn_timer, topology_change_timer, and port-specific timers inside struct net_bridge. That structure is held in the private data area of the bridge’s net_device.

As a result, the timers must be removed before the backing network device is released. If they remain queued after the memory is freed, the kernel may later attempt to execute a timer callback through a stale memory reference.

Linux Kernel Bridge Use-After-Free Vulnerability

According to SSD Disclosure, the bug stems from different cleanup behavior between normal interface shutdown and direct bridge deletion.

During a standard UP-to-DOWN transition, the ndo_stop path reaches br_stp_disable_bridge(), which synchronously cancels STP timers through del_timer_sync(). This prevents pending callbacks from accessing released bridge data.

However, deleting a bridge via the delink path invokes br_dev_delete() and does not trigger the same STP cleanup routine. If the interface is already down, the device-unregistration process can also skip ndo_stop.

This leaves armed timers attached to a per-CPU timer base even though the associated net_device is subsequently freed. When the kernel’s timer processing routine later handles the dangling timer in softirq context, it may dereference freed memory.

Researchers noted that controlled reallocation of the released slab object could potentially turn the bug into a control-flow hijacking primitive, raising the impact beyond a crash or denial-of-service scenario.

The public PoC demonstrates the affected lifecycle and underscores the importance of timely remediation in environments that allow bridge configuration changes.

A Linux kernel patch has been introduced in commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems running kernels before that change should be treated as affected and updated via their distribution’s supported kernel packages.

Until patched kernels are deployed, administrators should restrict untrusted users’ ability to create, modify, or remove bridge interfaces and review workloads that use kernel STP.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Public PoC Released for Linux Kernel Bridge Use-After-Free Vulnerability appeared first on Cyber Security News.