linuxsecurity.com / .linuxsecurity-com-linuxsecurity-articles / Page 9

Two Linux fixes show how extended Berkeley Packet Filter (eBPF) security can fail when mutable map data crosses into the exec path, where Linux starts a program.

A Linux GPU security fix changes how AMD's Kernel Fusion Driver (KFD) tracks shared mappings when several containers use one device.

runc 1.5.2 adds a workaround for a Linux cgroup v2 memory-corruption bug that can make the privileged container runtime crash unpredictably.

A new arm64 Kernel-based Virtual Machine (KVM) merge tightens two ordinary-looking mechanisms with major security weight: page mappings for protected-hypervisor stacks and the lifetime of memory-management state used by nested virtual machines.

Manufacturing security tends to fail at the seam between information technology and operational technology.

A Linux io_uring race can let a polling thread release ring state while the CPU that published the work is still using it.

Linux is not a standard environment. An enterprise can run many different flavors of Linux on its servers, desktops and specialized systems, each with its own set of software packages, dependencies and updates.

Corrupted ext4 metadata can direct a Linux kernel copy past the inode region that is supposed to contain inline data.

A Linux ext4 race can corrupt a directory while the filesystem converts it from inline storage to a regular block.

A Linux USB/IP timer can restart after device teardown has begun, leaving the kernel callback able to use a virtual controller that has already been freed.