RefluXFS is a Linux kernel LPE flaw (CVSS 7.8). A race in the XFS copy-on-write path lets an unprivileged user overwrite any readable file on disk and become root. It works even under SELinux Enforcing.

How Linux live kernel patching works: ftrace-based function redirection, the consistency model, the livepatch subsystem, and the kpatch, Ksplice, kGraft, Canonical Livepatch and KernelCare tools. Practice and limitations.

Januscape is a KVM flaw that lets a guest escape to the host. A 16-year-old bug in the shadow MMU, working on both Intel and AMD, collapses multi-tenant isolation. Requires nested virtualization.

DirtyClone is a Linux kernel LPE flaw (CVSS 8.8). A local user gains root by overwriting /usr/bin/su in the page cache through a cloned network packet. No disk changes, no logs.

Linux 7.1 hit mainline on June 14, 2026. A from-scratch NTFS driver, Intel FRED by default, new clone3() flags, sched_ext sub-schedulers and more.

What eBPF is and what you can actually do with it: observability with bpftrace, packet filtering with XDP, runtime security and hardening. A practical guide.

The new Modules tab in Kernel Security Checker: paste your lsmod output and get a list of modules that are unnecessary attack surface or tied to a CVE, plus a ready-to-use blacklist for /etc/modprobe.d/.

A week after CopyFail, the same researcher found another page cache escalation. Dirty Frag is a chain of two flaws in ESP (IPsec) and RxRPC. What it is, who is affected, and how to defend.

The new Vulnerabilities section in Kernel Security Checker: enter your kernel version, get a list of known public exploits matched to your kernel.

Comparison of three major kernel vulnerabilities: Dirty COW, Dirty Pipe and CopyFail. Different mechanisms, same result: page cache write and privilege escalation.