The Linux 7.3 cycle — with rc2 out on September 6, 2026 and rc3 on September 13 — stands out for filesystem and BPF verifier hardening, plus a surge in sched_ext work. Teams that will maintain this kernel long-term should anticipate which security fixes to backport.

Attackers can wipe logs, tamper with timestamps, and kill your EDR. They can’t make the packets that crossed your network disappear. Here’s how to capture them, dissect them, and turn them into unassailable evidence using three essential tools.