Loading story…
Debian and F5 issued security advisories for multiple Linux kernel vulnerabilities after disclosure of CVE-2026-31533, a flaw in the kernel net/tls subsystem. Google security research documentation describes the bug as a use-after-free in the -EBUSY error path of tls_do_encryption(), caused by a double decrement of the encrypt_pending sentinel and a double scatterlist restore, creating a condition that can corrupt kernel memory.
The vulnerability was reported as having been exploited as a zero-day against lts-6.12.77 and cos-121-18867.381.30, and the published kernelCTF material said the issue reproduced reliably in an exploit_repro workflow. The coordinated advisories indicate downstream impact across Linux-based products, with Debian shipping DSA 6355-1 for linux and F5 warning customers about multiple Linux kernel vulnerabilities that include the affected code base.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A Google security-research pull request added a kernelCTF entry for CVE-2026-31533, describing a use-after-free in the Linux kernel net/tls subsystem. The reference says the flaw had reportedly been exploited as a zero-day on lts-6.12.77 and cos-121-18867.381.30 and reproduced reliably in the referenced exploit workflow.
F5 published advisory K000161821 covering multiple Linux kernel vulnerabilities. The reference shows the advisory was released on that date.
Debian issued security advisory DSA 6355-1 for the Linux kernel. The reference indicates a Linux security update was published by Debian on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcegithub.com
Open sourcelists.debian.org
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 published security advisories for multiple **Linux kernel** vulnerabilities, including **CVE-2024-56615**, a bug in BPF map handling where signed integer indexing in **DEVMAP/XSKMAP** can lead to **out-of-bounds (OOB) writes** during element deletion and map free operations. The fix described changes index/iterator types from `int` to `u32` to prevent OOB access, with advisory details including an example kernel crash trace originating in `dev_map_free()`. F5 also documented **CVE-2024-56626** and **CVE-2024-56627** affecting the in-kernel SMB server **ksmbd** when `vfs objects = streams_xattr` is configured in `ksmbd.conf`: a client-supplied negative offset can trigger an **OOB write** in `ksmbd_vfs_stream_write` (CVE-2024-56626) and an **OOB read** in `ksmbd_vfs_stream_read` (CVE-2024-56627). In all three advisories, F5 states there is **no impact to F5 products** (either not affected or previously resolved) and provides no customer action beyond standard kernel patching practices in affected environments.
Jun 29, 2026
dCERT published two advisories, `2025-1332` and `2025-1527`, warning of **multiple vulnerabilities in the Linux kernel**. The notices indicate that separate sets of kernel flaws were significant enough to warrant dedicated advisories, underscoring continued security risk in one of the most widely deployed operating system components across servers, cloud infrastructure, appliances, and embedded systems. While no public synopsis was included in the referenced advisories, the alerts point organizations to review affected kernel versions, assess exposure across Linux-based assets, and apply vendor-provided updates or mitigations. Because kernel vulnerabilities can affect core system security boundaries and stability, unpatched systems may face elevated risk depending on the specific flaws and deployment context.
Jun 29, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 3, 2026