RefluXFS is a Linux kernel LPE flaw (CVSS 7.8). A race in the XFS copy-on-write path lets an unprivileged user overwrite any readable file on disk and become root. It works even under SELinux Enforcing.

How Linux live kernel patching works: ftrace-based function redirection, the consistency model, the livepatch subsystem, and the kpatch, Ksplice, kGraft, Canonical Livepatch and KernelCare tools. Practice and limitations.

Januscape is a KVM flaw that lets a guest escape to the host. A 16-year-old bug in the shadow MMU, working on both Intel and AMD, collapses multi-tenant isolation. Requires nested virtualization.

DirtyClone is a Linux kernel LPE flaw (CVSS 8.8). A local user gains root by overwriting /usr/bin/su in the page cache through a cloned network packet. No disk changes, no logs.

Linux 7.2-rc1 closed one of the busiest merge windows in years. Cache Aware Scheduling, the removal of strncpy, Rust on s390, HDMI 2.1 FRL for AMD and the first boot on Apple M3.

A ByteDance engineer moved a memset call in the iomap layer and squeezed out about 5% more IOPS on ext4 and XFS. The change lands in Linux 7.2.

Linux 7.1 hit mainline on June 14, 2026. A from-scratch NTFS driver, Intel FRED by default, new clone3() flags, sched_ext sub-schedulers and more.

What eBPF is and what you can actually do with it: observability with bpftrace, packet filtering with XDP, runtime security and hardening. A practical guide.

The new Modules tab in Kernel Security Checker: paste your lsmod output and get a list of modules that are unnecessary attack surface or tied to a CVE, plus a ready-to-use blacklist for /etc/modprobe.d/.

A week after CopyFail, the same researcher found another page cache escalation. Dirty Frag is a chain of two flaws in ESP (IPsec) and RxRPC. What it is, who is affected, and how to defend.