Patch Priority: An Emerging Tide of Linux Vulnerabilities Put Users in Hot Water

Several concerning vulnerabilities affecting Linux have emerged in recent months. The vulnerabilities include CISA Known Exploited Vulnerabilities (KEV) entries for CVE-2026-31431 (aka Copy Fail) [1], and an older flaw, CVE-2022-0492 [2]. However, a wave of concerning new vulnerabilities are associated with publicly available exploits or proof-of-concept (PoC) code. Collectively, the flaws represent local privilege escalation, container escape, arbitrary command execution as root, kernel heap corruption, and remote code execution (RCE). Linux users should regularly scan their infrastructure, conduct assessments to determine exposure, and prioritize patching to reduce risks to critical assets.

A Risk Assessment of Emerging Linux Kernel Vulnerabilities

In recent weeks, the Greenbone blog reviewed Copy Fail, a new actively exploited Linux vulnerability, along with Copy Fail 2 and Dirty Frag. Since then, several new vulnerabilities affecting the Linux kernel and core components have emerged, presenting significant operational risk within the Linux ecosystem.

A Technical Assessment of Emerging Linux Vulnerabilities

The following section reviews recently disclosed vulnerabilities affecting the Linux kernel and core components. Each section summarizes the underlying technical cause, available threat intelligence, potential temporary mitigations, and the upstream fixes.

CVE-2026-31705 Affecting ksmbd SMB Server

CVSS 9.8 · CriticalEPSS 0.1% (14th)No known exploitationPatch available

CVE-2026-31705 (CVSS 9.8, EPSS ≥ 31st pctl) is an out-of-bounds write in the Linux kernel ksmbd SMB server’s smb2_get_ea() path. A memset operation for 4-byte alignment runs without checking the remaining space. Exploitation allows compound SMB requests to overwrite adjacent kernel heap memory.

A detailed technical write-up is available online, increasing the risk to defenders [1]. No vendor provided workarounds have been published. However, shutting down KSMBD and/or unloading and blocking the ksmbd kernel module can reasonably prevent attacks from reaching the affected components. Upstream fixes are incorporated into Linux kernel versions 6.1.175, 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31705 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CVE-2026-55200 Affecting libssh2

CVSS 8.3 · HighEPSS 0.9% (55th)Public PoC

CVE-2026-55200 (CVSS 8.3, EPSS ≥ 78th pctl) affects libssh2. The flaw is an out-of-bounds write in ssh2_transport_read() caused by an unchecked attacker-controlled packet_length field. A malicious or compromised SSH server can send crafted SSH packets to trigger memory corruption and achieve RCE.

Detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2]. No workaround mitigation is available except for preventing libssh2 clients from connecting to untrusted SSH servers, such as disabling the service. CVE-2026-55200 affects all libssh2 versions up to and including 1.11.1. No fixed upstream release has yet been published, but the correction is available in upstream commit 97acf3df and has been backported by some Linux distributions. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-55200 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Fragnesia: CVE-2026-46300 (CVSS 7.5)

CVSS 7.8 · HighEPSS 0.1% (17th)Public PoC

Dubbed Fragnesia, CVE-2026-46300 (CVSS 7.8, EPSS ≥ 83th pctl) is caused by shared-fragment marker loss during skb coalescing in the Linux kernel’s net/skbuff and ESP input paths. Later in-place ESP processing allows decryption of page-cache-backed fragments. The issue is considered a trivial-to-exploit local privilege-escalation risk because it can corrupt page-cached read-only files. Ubuntu says exploitation can elevate a local user to root on affected hosts and that container-escape scenarios are also possible.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. Temporary mitigation can be achieved by unloading and blocking the esp4 and esp6 kernel modules [6]. CVE-2026-46300 affects Linux kernel versions 3.9 and later. Upstream fixes are incorporated into versions 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46300 and continues to add package-level checks as Linux distributions issue security advisories and patches.

ssh-keysign-pwn: CVE-2026-46333 (CVSS 7.1)

CVSS 7.1 · HighEPSS 0.0% (0th)Public PoC

Dubbed ssh-keysign-pwn, CVE-2026-46333 (CVSS 7.1, EPSS ≥ 71st pctl) is a race in Linux kernel ptrace and process-exit handling. The issue centers around dumpability and mm teardown. During a privileged process exit, pidfd_getfd() can duplicate open file descriptors from the dying process. Exploitation can expose sensitive root-owned material, including SSH keys and password hashes. The public proof-of-concept for this issue requires the pidfd_getfd syscall; a system call that can duplicate a file descriptor from another process. The kernel fix requires the CAP_SYS_PTRACE capability to inspect or control another process when the target process is exiting, known as the “no-mm” case.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5][6]. Temporary mitigation can be achieved by blocking all unprivileged users or only for users without the CAP_SYS_PTRACE privilege from attaching to other processes using the ptrace() system call [7]. CVE-2026-46333 is a Linux kernel vulnerability rather than an OpenSSH flaw. Patches are incorporated into Linux kernel versions 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.89, 6.18.31, 7.0.8, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46333 and continues to add package-level checks as Linux distributions issue security advisories and patches.

DirtyDecrypt / DirtyCBC: CVE-2026-31635 (CVSS 7.5)

CVSS 7.5 · HighEPSS 0.0% (4th)Public PoC

Dubbed DirtyDecrypt (and DirtyCBC), CVE-2026-31635 (CVSS 7.5, EPSS ≥ 53rd pctl) affects Linux kernels with CONFIG_RXGK compiled in and enabled. An inverted bounds check in RxRPC / RxGK response validation allows oversized RESPONSE authenticators to be accepted and passed deeper into processing. Secondary reporting says the flaw can overwrite page-cached privileged files and be used for local privilege escalation to root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4][5]. No vendor provided workarounds have been published. However, independent researchers have suggested unloading and blocking the rxrpc module as a temporary solution [6]. Upstream fixes for CVE-2026-31635 are incorporated into Linux kernel versions 6.18.23, 6.19.13, and 7.0. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-31635 and continues to add package-level checks as Linux distributions issue security advisories and patches.

CIFSwitch: CVE-2026-46243 (CVSS 7.1)

CVSS 7.1 · HighEPSS 0.0% (4th)Public PoC

Dubbed CIFSwitch, CVE-2026-46243 (CVSS 7.1, EPSS ≥ 28th pctl) affects cifs_spnego handling in the Linux kernel’s CIFS client. The issue allows userspace to forge cifs.spnego key descriptions through request_key(2) or add_key(2), causing cifs.upcall to trust attacker-controlled authority fields. The flaw allows a low-privilege local user to trigger arbitrary command execution as root.

Several technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. The temporary workaround is to unload and block the cifs kernel module, remove cifs-utils, or deactivate the cifs.spnego request-key rule [5]. CVE-2026-46243 affects Linux kernel with the CIFS client or cifs-utils, and the cifs.spnego request-key integration. Upstream fixes are incorporated into versions 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-46243 and continues to add package-level checks as Linux distributions issue security advisories and patches.

PinTheft: CVE-2026-43494 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.0% (10th)Public PoC

Dubbed PinTheft, CVE-2026-43494 (CVSS 7.8) affects the Linux kernel RDS zerocopy send path. The bug stems from cleanup logic that frees already released pages after op_nents is left nonzero. The exploit chain uses io_uring fixed buffers to overwrite the page cache of a SUID-root binary.

Several detailed write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. Workaround mitigation can be achieved by ensuring that the rds module is unloaded and blocked from automatic loading [5]. CVE-2026-43494 affects Linux kernel versions 4.17 and later with the RDS subsystem. Upstream fixes are incorporated into Linux kernel versions 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43494 and continues to add package-level checks as Linux distributions issue security advisories and patches.

GhostLock: CVE-2026-43499 (CVSS 7.8)

CVSS 7.8 · HighEPSS 0.0% (7th)Public PoC

Dubbed GhostLock, CVE-2026-43499 (CVSS 7.8) is a use-after-free in the Linux kernel rtmutex slowlock and proxy-lock rollback path. The remove_waiter() function leaves a dangling pointer and unsafe locking state. Red Hat and Ubuntu describe local privilege-escalation and denial-of-service impact [1][2], and Nebula says container escape is also possible on unpatched systems.

Several detailed technical write-ups and PoC exploits are available online, increasing the risk to defenders [1][2][3][4]. No workaround mitigation is available. CVE-2026-43499 affects Linux kernel versions 2.6.39 and later with upstream fixes incorporated into versions 5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1. Greenbone’s OPENVAS ENTERPRISE FEED includes detection for CVE-2026-43499 and continues to add package-level checks as Linux distributions issue security advisories and patches.

Mitigation for Emerging Linux Vulnerabilities

Organizations should prioritize patching for emerging Linux vulnerabilities based on the operational and business value of affected assets, the reachability of affected systems, each flaw’s technical details, and threat intelligence, including known active exploitation and the existence of PoC exploits.

Mitigating vulnerabilities found in the upstream Linux kernel depends on either implementing effective workarounds or installing updates in downstream Linux distributions when they become available. Where technical workarounds are not available, defenders must upgrade to fixed kernel builds.

Summary

Recent Linux kernel and core component vulnerabilities have exposed organizations to new risks. The potential impacts include local privilege escalation, container escape, arbitrary command execution, memory corruption, and RCE. Publicly available technical analyses and proof-of-concept exploits increase the urgency. When prioritizing patches, defenders must identify all affected systems and consider asset criticality, business risk, reachability, and exploitability.