A series of vulnerabilities has been discovered in the Linux and FreeBSD kernels. Vulnerabilities in Linux allow for remote code execution, privilege escalation within the system, escaping from containers, or bypassing virtual machine isolation. Vulnerabilities in FreeBSD permit remote shutdown of the kernel, privilege escalation within the system, and bypassing Bhyve hypervisor isolation.
Vulnerabilities in the Linux kernel:
- 5 vulnerabilities revealed by the Zero Day Initiative before patches were published due to erroneous information submission to the wrong mailing list:
- ZDI-CAN-33549 — vulnerability in the ksmbd module implementing file sharing server based on the SMB protocol, which can be exploited for remote code execution at the kernel level. The issue is caused by an integer overflow in the mbdirect_connection_rdma_xmit() function, which occurs if the kernel is built with the options 'CONFIG_SMB_SERVER_SMBDIRECT=y' and 'CONFIG_RDMA_RXE=y'. For a successful attack, the attacker must have write access to the shared storage provided by the target system proxy server, which must also utilize RDMA and SMB Direct technology. A working exploit prototype is available for Debian 13.
- ZDI-CAN-33774 — race condition in the ksmbd kernel module, leading to writing 62 bytes of data from the SMB2 header into a 40-byte buffer allocated for the SMB1 protocol. The vulnerability may lead to remote code execution if there is access to the SMB storage managed through ksmbd. An exploit prototype is available, working in Debian 13.
- ZDI-CAN-33367 — vulnerability in the kernel's network stack allowing a local user to gain root privileges in the system by overwriting process data in the page cache, similar to the Dirty Frag and Fragnesia vulnerabilities. This time, the issue is caused by an error in the function
skb_zerocopy() function. A working exploit prototype has been prepared for different versions of Ubuntu. A fix is available in the form of a patch. Currently, only the Alma Linux developers have created an unscheduled package update with a kernel that addresses this vulnerability. - ZDI-CAN-34068 — buffer overflow in the VMWGFX graphics driver used for implementing 3D acceleration in VMware environments. The issue allows a local user to gain root privileges in the system if they have access to a virtual GPU through the /dri/card* device. An exploit prototype is available, working in Ubuntu 26.04.
- ZDI-CAN-34076 — vulnerability in the nvmet (NVMe Target) driver leading to information leakage about the contents of kernel memory.
- Details have been disclosed and exploit prototypes have been published for 5 vulnerabilities in the kernel, allowing a non-privileged user to gain root privileges in the system and bypass container isolation. This set of vulnerabilities has been codenamed 'Infinity Core'. The issues have already been fixed in current kernel releases.
- CVE-2026-98260 — memory access after it has been freed due to the reuse of a POSIX timer structure, the memory for which was freed in the main thread after a failure during an exec() call, but the reference remained in the queue (timerqueue) in another thread. An exploit prototype is available, demonstrated in Ubuntu 26.04 and on Android on the Samsung Galaxy S26 Ultra.
- CVE-2026-98256 — a memory access after it has been freed due to a race condition between the exec() call in a secondary thread and the clearing of the signal queue (sigqueue) waiting for processing. Manipulations with the queue can lead to a situation where the reference to the signal handler remains in the queue after the memory associated with it has been freed, and will then be used during signal processing. The exploit's operation has been demonstrated in Ubuntu 26.04.
- CVE-2026-89754 — a buffer overflow in the implementation of the mincore() system call, occurring due to a race condition when re-scanning the page tables after executing madvise(MADV_DONTNEED). The exploit's operation has been demonstrated in Ubuntu 26.04.
- CVE-2026-80775 — a memory access after it has been freed in the prctl() system call, arising from incorrect tracking of reference counters for futex hashes during their occurrence.
a race condition between tasks sharing a single mm_struct structure during a nested vfork() call. An exploit utilizing the vulnerability to overwrite /usr/bin/passwd in the page cache has been demonstrated on Ubuntu 26.04. - CVE-2026-98385 — a memory access after it has been freed in the task scheduler cache handler, occurring because the scheduler updates the statistics fields in the mm_struct for the task after the memory associated with it has been freed when executing the exec() call on another CPU core. The vulnerability manifests in kernels with the CONFIG_SCHED_CACHE option enabled. The exploit's operation has been demonstrated in.
Arch Linux with kernel 7.2.4.
- Vghost vulnerability (CVE-2026-74580) in the vhost kernel subsystem, used to accelerate input/output operations via Virtio in virtualization systems. The vulnerability is caused by incorrect handling of the Input/Output Address Translation Cache (IOTLB) and can be exploited to elevate privileges in the system and bypass guest system isolation. When reconfiguring addresses or queue sizes (vring) through VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM calls, the vq->meta_iotlb[] cache was not cleared, leading to the translation of new addresses using already invalid memory mapping records.
A prototype exploit for gaining root privileges has been published, tested on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023.12.20260817, Azure Linux 3.0, and Oracle Linux 10.2.
The vulnerability may be used to execute code at the host system's kernel level through manipulations with the VIRTIO_F_RING_RESET call in the guest system in virtualized environments with virtual IOMMU.
The issue is present starting from Linux kernel 4.11 and has been fixed in versions 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. As a mitigation, access to devices /dev/vhost-net, /dev/vhost-vsock, /dev/vhost-scsi, and /dev/vhost-vdpa-* can be restricted.
Vulnerabilities in FreeBSD (fixed in updates 15.1-RELEASE-p5, 14.5-RELEASE-p2, and 14.4-RELEASE-p11):
- CVE-2026-101308 — a memory access after it has been freed in the sound driver, occurring due to a race condition between buffer resizing and memory mapping via mmap. The vulnerability potentially allows a local user with access to the audio device to gain root privileges.
- CVE-2026-101309, CVE-2026-101310, CVE-2026-101311 — vulnerabilities in the Bhyve hypervisor components that allow for code execution on the host environment through manipulation in the guest system. The issues are caused by buffer overflows due to a race condition in the xHCI (USB 3) controller model, as well as a lack of size checks for entries in HDA (High Definition Audio) and framebuffer device models.
- CVE-2026-101307 — an integer overflow in the tcp_rack module with the implementation of the RACK (Recent ACKnowledgment) packet loss detection algorithm, leading to buffer allocation too small to accommodate all received data. The vulnerability allows for overwriting up to 512 KB in the buffer overflow area by sending a large number of ACK packets in an established TCP connection. It is noted that exploitation may lead to kernel panic.
Source: opennet.ru
