{"id":184020,"date":"2026-10-27T23:40:54","date_gmt":"2026-10-27T21:40:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/10-uyazvimostej-v-yadre-linux-i-4-vo-freebsd-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2026-10-27T23:40:59","modified_gmt":"2026-10-27T21:40:59","slug":"10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access","title":{"rendered":"10 vulnerabilities in the Linux kernel and 4 in FreeBSD that allow obtaining root privileges in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A series of vulnerabilities has been discovered in the Linux and FreeBSD kernels. Vulnerabilities in Linux allow for remote code execution, privilege escalation within the system, escaping from containers, or bypassing virtual machine isolation. Vulnerabilities in FreeBSD permit remote shutdown of the kernel, privilege escalation within the system, and bypassing Bhyve hypervisor isolation.<\/p>\n<p>Vulnerabilities in the Linux kernel:<\/p>\n<ul>\n<li class=\"l\"> 5 vulnerabilities revealed by the Zero Day Initiative before patches were published due to erroneous information submission to the wrong mailing list:\n<ul>\n<li class=\"l\"> ZDI-CAN-33549 \u2014 a vulnerability in the ksmbd module implementing file sharing <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> based on the SMB protocol, which can be exploited for remote code execution at the kernel level. The issue arises from an integer overflow in the mbdirect_connection_rdma_xmit() function, which occurs when the kernel is built with the options 'CONFIG_SMB_SERVER_SMBDIRECT=y' and 'CONFIG_RDMA_RXE=y'. For a successful attack, the attacker must have write access to the shared storage provided by the target <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/server\/dts-prohoster\/\"   title=\"proxy server\" data-wpil-keyword-link=\"linked\">proxy server<\/a>, which must also utilize RDMA and SMB Direct technology. A working exploit prototype is available for Debian 13.\n<li class=\"l\"> ZDI-CAN-33774 \u2014 a race condition in the ksmbd kernel module leading to a write to a 40-byte buffer allocated for the SMB1 protocol with 62 bytes of data from the SMB2 header. This vulnerability may allow for remote code execution if access to the SMB storage processed through ksmbd is available. A working exploit prototype is available for Debian 13.\n<li class=\"l\"> ZDI-CAN-33367 \u2014 a vulnerability in the kernel's network stack allowing a local user to gain root privileges by overwriting process data in the page cache, similar to the Dirty Frag and Fragnesia vulnerabilities. This time, the issue arises from an error in the<br \/>\nskb_zerocopy() function. A working exploit prototype has been prepared for different versions of Ubuntu. A fix is available in the form of a patch. Currently, only the Alma Linux developers have created an unscheduled package update with a kernel that addresses this vulnerability.<\/p>\n<li class=\"l\"> ZDI-CAN-34068 \u2014 a buffer overflow in the VMWGFX graphics driver used for 3D acceleration in VMware environments. This issue allows a local user to gain root privileges within the system if they have access to the virtual GPU through the \/dri\/card* device. A working exploit prototype is available for Ubuntu 26.04.\n<li class=\"l\"> ZDI-CAN-34076 \u2014 vulnerability in the nvmet driver (NVMe Target) leading to leakage of information about kernel memory contents.\n<\/ul>\n<li class=\"l\"> Details and prototypes of exploits for 5 vulnerabilities in the kernel have been published, allowing non-privileged users to gain root rights in the system and bypass container isolation. This set of vulnerabilities is codenamed \"Infinity Core.\" The issues have already been addressed in the latest kernel releases.\n<ul>\n<li class=\"l\"> CVE-2026-98260 \u2014 use after free due to the reuse of a POSIX timer structure, where the memory was freed in the main thread after a crash during the exec() call, but the reference remained in the timer queue in another thread. A prototype exploit is available, demonstrated on Ubuntu 26.04 and on a Samsung Galaxy S26 Ultra smartphone.\n<li class=\"l\"> CVE-2026-98256 \u2014 use after free due to a race condition between the exec() call in a secondary thread and the cleanup of the signal queue (sigqueue) awaiting processing. Manipulations with the queue can lead to a situation where the reference to the signal handler remains in the queue after the associated memory has been freed and is then used in signal processing. The exploit has been demonstrated on Ubuntu 26.04.\n<li class=\"l\"> CVE-2026-89754 \u2014 buffer overflow in the implementation of the mincore() system call, arising from a race condition during a re-iteration of memory page tables after performing madvise(MADV_DONTNEED). The exploit has been demonstrated on Ubuntu 26.04.\n<li class=\"l\"> CVE-2026-80775 \u2014 use after free in the prctl() system call due to improper tracking of reference counters for futex hashes during the occurrence of<br \/>\na race condition between tasks sharing a single mm_struct structure during a nested vfork() call. An exploit utilizing the vulnerability to overwrite \/usr\/bin\/passwd in the page cache has been demonstrated on Ubuntu 26.04.<\/p>\n<li class=\"l\"> CVE-2026-98385 \u2014 use after free in the task scheduler's cache handler, occurring because the scheduler updates statistics fields in the mm_struct for a task after freeing its associated memory when executing exec() on another CPU core. The vulnerability manifests in kernels with the CONFIG_SCHED_CACHE option enabled. The exploit's operation was demonstrated in<br \/>\nArch Linux with kernel 7.2.4.<\/p>\n<\/ul>\n<li class=\"l\"> The Vghost vulnerability (CVE-2026-74580) in the vhost kernel subsystem, used to accelerate input\/output operations via Virtio in virtualization systems. The vulnerability is caused by incorrect handling of the Input\/Output Translation Lookaside Buffer (IOTLB) cache and can be exploited to escalate privileges in the system and bypass guest system isolation. When reconfiguring addresses or queue sizes (vring) through VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM calls, the vq-&gt;meta_iotlb[] cache was not cleared, leading to new addresses being translated using already invalid mapping entries.\n<p>A prototype exploit for gaining root privileges has been published, tested on Ubuntu 26.04, RHEL 9.8, Amazon Linux 2023.12.20260817, Azure Linux 3.0, and Oracle Linux 10.2.<br \/>\nThe vulnerability may be used to execute code at the host system's kernel level through manipulations with the VIRTIO_F_RING_RESET call in the guest system in virtualized environments with virtual IOMMU.<br \/>\nThe issue is present starting from Linux kernel 4.11 and has been fixed in versions 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. As a mitigation, access to devices \/dev\/vhost-net, \/dev\/vhost-vsock, \/dev\/vhost-scsi, and \/dev\/vhost-vdpa-* can be restricted.<\/p>\n<\/ul>\n<p>Vulnerabilities in FreeBSD (fixed in updates 15.1-RELEASE-p5, 14.5-RELEASE-p2, and 14.4-RELEASE-p11):<\/p>\n<ul>\n<li class=\"l\"> CVE-2026-101308 \u2014 use after free in the sound driver, occurring due to a race condition between buffer resize operations and memory mapping via mmap. The vulnerability potentially allows a local user with access to the sound device to gain root privileges.\n<li class=\"l\"> CVE-2026-101309, CVE-2026-101310, CVE-2026-101311 \u2014 vulnerabilities in the Bhyve hypervisor components that allow code execution on the host environment through manipulations in the guest system. These issues are caused by buffer overflows due to a race condition in the xHCI (USB 3) controller model, as well as a lack of size checks for records in HDA (High Definition Audio) device models and framebuffer.\n<li class=\"l\"> CVE-2026-101307 \u2014 an integer overflow in the tcp_rack module implementing the RACK (Recent ACKnowledgment) packet loss detection algorithm, leading to the allocation of a buffer that's too small to hold all received data. This vulnerability allows overwriting up to 512 KB in the buffer overflow area when sending a large number of ACK packets in an established TCP connection. It has been noted that exploitation may lead to a kernel crash in a panic state.\n<\/ul>\n<p>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66542\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 FreeBSD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043e FreeBSD \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u044f\u0434\u0440\u0430, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440\u0430 Bhyve. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux: 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184020","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 FreeBSD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 4 \u0432\u043e FreeBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 FreeBSD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-27T21:40:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-27T21:40:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4710 vulnerabilities in the Linux kernel and 4 in FreeBSD that allow gaining root privileges in the system | ProHoster","description":"A series of vulnerabilities have been identified in the Linux and FreeBSD kernels. The vulnerabilities in Linux allow for remote code execution, privilege escalation within the system, exiting containers, or bypassing virtual machine isolation.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4710 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 4 \u0432\u043e FreeBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u044f\u0434\u0440\u0435 Linux \u0438 FreeBSD. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Linux \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434, \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438\u043b\u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/10-linux-kernel-vulnerabilities-and-4-in-freebsd-that-allow-root-access","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-27T21:40:54+00:00","article:modified_time":"2026-10-27T21:40:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/184020","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=184020"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/184020\/revisions"}],"predecessor-version":[{"id":184021,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/184020\/revisions\/184021"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=184020"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=184020"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=184020"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}