Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.
A use-after-free flaw in Linux's KVM hypervisor, nicknamed Januscape and hidden in the code for about 16 years, lets a virtual machine attack the physical host it runs on. Tracked as CVE-2026-53359, it sits in the shadow memory code that KVM uses on both Intel and AMD systems when nested virtualization is enabled. From inside a guest with root, an attacker can corrupt host kernel memory: the public proof-of-concept crashes the entire host, taking down every other tenant on that machine, and the researcher says a private exploit can run code as root on the host. The fix reached mainline Linux in June, and distributions are shipping updated kernels now.
A newly disclosed Linux kernel vulnerability called Bad Epoll lets an ordinary user with no special privileges take full control of a machine as root, and it affects Linux desktops, servers, and Android. Tracked as CVE-2026-46242, the flaw is a use-after-free in epoll, a core Linux feature for watching many files or connections at once that programs and browsers rely on and cannot simply turn off. Two parts of the kernel try to free the same object at once, letting an attacker corrupt kernel memory and climb to root. It is a race-condition bug, harder to exploit than recent deterministic Linux flaws, but a working exploit exists and a fix is available.
Researchers at LucidBit Labs detailed an eight-year-old use-after-free flaw in the kernel of Samsung's KNOX security framework that affected a huge range of Galaxy devices, from the Galaxy S9 to the S25, across A-series and both Exynos and Qualcomm models. The bug (CVE-2026-20971) sits in a race between two KNOX components that verify process integrity, and a malicious app could exploit it to corrupt kernel memory and potentially take full control of the device. Samsung quietly fixed it in its January 2026 security update. Exploitation requires local access and some user interaction, but a lost, borrowed, or stolen phone makes that realistic.
Team Xint Code has disclosed CVE-2026-23479, a use-after-free remote code execution flaw in Redis that sat unnoticed in every stable branch from 7.2.0 until the May 5 fixes - over two years. The bug lives in unblockClientOnKey(), which keeps using a client pointer after processCommandAndResetClient() can free it. Exploitation needs an authenticated session, but Wiz's analysis finds Redis in most cloud environments with the majority running passwordless, where the default user already holds every privilege the exploit chain requires. The published exploit leaks a heap pointer via Lua, reclaims a freed client with a fake structure, and overwrites a GOT entry to repoint strcasecmp() at system(). NVD rates it 8.8.
Exim, the open-source mail transfer agent that ships as default on Debian and powers a large slice of internet mail, has a critical use-after-free in how it parses message bodies sent with the BDAT chunking extension over TLS. The flaw, CVE-2026-45185 (CVSS 9.8) and nicknamed Dead.Letter by discoverer XBOW, triggers when a TLS connection closes via close_notify mid-BDAT and Exim then processes one more cleartext byte. That byte gets written into already-freed memory, corrupting the heap, and XBOW turned it into an unauthenticated RCE primitive. Only Exim builds compiled with USE_GNUTLS=yes are affected; OpenSSL builds are not.
TrustStrike Labs