On 18 September 2026, researcher Asim Manizada published working exploits for four Linux kernel flaws — DirtyAH6, TUNderflow, PPPoEject and DiagSpill — each of which gives root to any local user. The fixes have been available for weeks, so check your kernel version and restrict unprivileged user namespaces now.
On September 24, 2026, maintainer Sasha Levin proposed adding an AGENTS.md file to the Linux kernel repository to fix attribution mistakes made by AI agents that generate patches. The proposal, debated on LKML, raises a real question: steer agents with a single file or with purpose-built documentation.
On September 24, 2026, Greg Kroah-Hartman merged into driver-core-next a new taint flag, TAINT_FORCED_BIND, that marks kernels whose sysfs bind/unbind files have been written. It targets fuzzing bots like syzbot that arbitrarily bind drivers to devices and drown maintainers in pointless bug reports.
On September 20, 2026, Linus Torvalds released Linux 7.3-rc4, a “bigger than usual” candidate that rejects an Intel Granite Rapids microcode capable of machine check exceptions and lands a wave of error-path fixes caught by LLMs. Testers on Intel hardware should update immediately.
Patched upstream on August 6, 2026 in the Linux kernel, CVE-2026-80521 remains unfixed in Ubuntu 26.04, 24.04, and 22.04 LTS, and DepthFirst published a container-escape exploit on September 22. If you host untrusted workloads, apply the upstream patch or isolate them in microVMs.
On September 21, 2026, AMD posted AMDGPU kernel patches that add the GDDR7 memory identifier and new IP blocks, signalling the first RDNA5 GPUs. Linux users get the benefit of this open-source enablement months before any card ships.
On September 13, 2026 Linus Torvalds released Linux 7.3-rc3, another fairly large rc driven by XFS and the SMB client, against the backdrop of Greg Kroah-Hartman’s warning that AI-generated patches are overwhelming maintainers. Follow the Assisted-by policy and take stock of what the AI wave changes for kernel contributors.
On September 18, 2026, Google submitted the patch that removes 11,000 lines of the C Binder driver, replaced by the Rust version upstreamed in Linux 6.18 and slated for Linux 7.4. It is the first time a major kernel driver moves entirely to Rust.
On September 18, 2026, CISA added three Linux kernel vulnerabilities to the KEV catalog: a race in AF_ALG, an out-of-bounds write in ebtables SNAT, and mishandled zero-length TLS records. Patch before September 21 and confirm your distribution has backported all three commits.
The Linux 7.3 cycle — with rc2 out on September 6, 2026 and rc3 on September 13 — stands out for filesystem and BPF verifier hardening, plus a surge in sched_ext work. Teams that will maintain this kernel long-term should anticipate which security fixes to backport.
Red Hat has published a bulletin for CVE-2026-53362, an out-of-bounds write in the Linux kernel’s IPv6 fragmentation path that lets a local user escape a container and bypass SELinux. Apply the patched kernel, or disable unprivileged user namespaces in the meantime.
Stable kernels 7.2.5 and 6.18.51, released September 11, 2026, fix video output for Blackwell GPUs in nouveau and close a memory leak and a use-after-free in ksmbd. Update first if you expose SMB shares or run a Blackwell card.
CVE-2026-43499, dubbed GhostLock, is a use-after-free in rtmutex priority-inheritance code that has shipped since kernel 2.6.39 and is reachable by any unprivileged local process. The fix landed in 7.1, but two months after the public PoC, blind spots like RHEL 9 kernel-rt remain: check your version and block PI futexes in the meantime.
Two optimizations merged into the Linux 7.3 merge window cut memory-management lock contention: the worst-case anon_vma lock hold time drops from 705 ms to 1.67 ms, and the zsmalloc path speeds up by as much as 1.83× on modest hardware. Teams running JVMs, databases or KSM under memory pressure get a direct latency win just from upgrading.
The rc2 of Linux 7.3 fixes cache-aware scheduling misfits on hybrid CPUs and keeps migrating kernel allocations to kmalloc_obj. Test this rc2 if you run Intel Core hybrid or big.LITTLE machines.
On September 2, 2026, Greg Kroah-Hartman warned that the Linux 7.3 cycle is shaping up to be ’rough’: his USB subsystem queue is overflowing with AI-generated patches, while the kernel approaches 2,000 CVEs per release. For distros and infrastructure teams, that means prioritizing real security fixes and bracing for a stable release around October 18.
Between 23 and 29 August 2026, the Linux project published 227 CVEs, five times a normal week, as a full stable cycle landed on 28 August across all eight active branches. Update to the latest release on your branch, but track the four flaws that no stable fix covers separately.
An out-of-bounds write in the Linux kernel’s IPv6 UDP fragment handling, rated CVSS 7.8, lets a local attacker escalate privileges and is already being exploited — CISA added it to the KEV catalog on 27 August 2026. Patch the kernel before 30 August and treat IPv6 as something you monitor, not just route.
Linux 7.3’s merge window opened in mid-August 2026 with 1,250 memory-management patches, a feature-complete sched_ext and initial support for AMD UALink and the Apple M3. Admins under memory pressure have two concrete fixes — rmap_walk_ksm and zsmalloc — to plan for before the expected October 2026 release.
A hung EFI runtime service call used to wedge an entire host: the kworker stayed trapped inside firmware while holding efi_runtime_lock until someone rebooted the machine. Linux 7.3 adds a 120-second timeout that declares the firmware ’wedged’ and turns a silent freeze into an explicit dmesg verdict.
On August 22, 2026, the Linux kernel recorded the departure of Steve French, maintainer of the CIFS/SMB3 client since 2002, for health reasons. The subsystem passes to Paulo Alcantara and Namjae Jeon, and the community learned the same day that he had died.
Merged this week for Linux 7.3, the stack randomization rework led by Thomas Gleixner moves the computation to the earliest possible point and unifies the architecture-specific code. Maintainers of hardened systems have a reason to watch this merge window.
On August 16, 2026, Linus Torvalds released the stable Linux 7.2 kernel after seven release candidates, bringing cache-aware scheduling, USB4STREAM host-to-host transfers, and measured gains on EXT4, XFS, and MongoDB. For administrators, this is a performance release that arrives through the standard distro kernel update — the real work is testing MySQL and MongoDB workloads before rolling it out.
On August 9, 2026, Linus Torvalds published the seventh release candidate of Linux 7.2. The patch volume remains higher than he would like, but he sees no reason to delay and confirms the stable release for next weekend. A breakdown of the final adjustments before the freeze.
Linux 7.2 Release Candidate 5 ships with over 35% of its patch volume in networking drivers — a post-conference backlog catch-up. The stable kernel is targeted for August 16, 2026. Sysadmins should schedule their validation windows now.
A use-after-free bug in the Linux kernel’s SCTP stack, dormant for 18 years and now tracked as CVE-2026-64564, lets a local attacker escalate to root and escape containers. Patches landed August 4, 2026 — kernel updates are not optional.
Greg Kroah-Hartman announces that drivers/staging/ will automatically reject all LLM-generated patches, except genuine security fixes tested on real hardware. A red line that protects the kernel's training ground.
The Linux 7.3 kernel, expected in September 2026, removes the FreeVxFS driver after twenty years of inactivity and welcomes FailFS, a fake filesystem for testing. This summer cleanup illustrates a maintenance philosophy that sets Linux apart from its competitors.
A finalized EEVDF scheduler, Rust as a first-class kernel language, self-healing XFS, and 2,362 contributors in a single cycle. The kernel that powers the vast majority of cloud workloads hits an industrial maturity milestone: early adopters get free performance without touching their config.
A finalized EEVDF scheduler, Rust as a first-class kernel language, self-healing XFS, and 2,362 contributors in a single cycle. The kernel that powers the vast majority of cloud workloads hits an industrial maturity milestone: early adopters get free performance without touching their config.
