Topic · 45 articles
Kernel & Security
Every week there's a CVE with a logo and a release with a changelog nobody reads. Most of it doesn't matter to you. Some of it really does, and the difference is rarely the CVSS score.
These are the MOTD takes on kernel releases, OS security advisories, and the hardening work that actually changes your threat model, plus the Tips that explain the mechanisms underneath. If you want the sandboxing primitives themselves, that's its own hub.
Start here
Read these first, in this order.
- 01
Tip · 2026-09-23
io_uring's attack surface and IORING_REGISTER_RESTRICTIONS
io_uring has been a CVE factory since it shipped in Linux 5.1. IORING_REGISTER_RESTRICTIONS locks down what a ring instance can do, but it only works if you apply it before handing the fd to untrusted code. Here is the actual API.
- 02
MOTD · 2026-09-22
io_uring shipped in 2019 to eliminate syscall overhead. It also became the most reliably exploited surface in the kernel. Production fleets are disabling it.
Google disabled io_uring across Android, Chrome, and their production Linux fleet. Ubuntu ships with unprivileged io_uring restricted by default. The Docker and Kubernetes default seccomp profiles block io_uring_setup. The performance case is still real. The security case for restriction is also real.
- 03
MOTD · 2026-09-24
The eBPF verifier is 30,000 lines of C, and it has the privilege-escalation CVEs to show for it
eBPF runs in the Linux kernel. The verifier that is supposed to make user-submitted programs safe is one of the largest, most complex files in the kernel tree, and every production distribution has disabled unprivileged BPF access. Here is the state of the restriction and why it exists.
- 04
MOTD · 2026-07-27
Everything is a critical CVE now, which means nothing is
CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.
- 05
MOTD · 2026-08-31
The xz backdoor was 28 months ago. Here is what the supply chain security scoreboard actually reads.
March 2024 was supposed to be the wake-up call that fixed open source supply chain security. It is August 2026. Here is the honest accounting of what improved, what did not, and why the underlying economics that made the attack possible have not fundamentally changed.
The syscalls underneath
Version introduced, sourced from the man page. Full cards in the syscall reference, or check your kernel.
| Interface | Since | What it does |
|---|---|---|
| io_uring_setup(2) | Linux 5.1 | Create an io_uring instance: shared submission/completion rings for async I/O. |
| getrandom(2) | Linux 3.17 | Fill a buffer with random bytes from the kernel CSPRNG, without opening /dev/urandom. |
| seccomp(2) | Linux 3.17 | Set the thread's seccomp state: strict mode or a BPF filter on every syscall. |
| landlock_create_ruleset(2) | Linux 5.13 | Create a Landlock ruleset fd, step one of unprivileged filesystem/network sandboxing. |
More console tips (2)
- getrandom(2) without the syscall: what Linux 6.11 finally shipped
- io_uring: why Jens Axboe's ring buffer is annoying to disagree with
MOTD (38)
- CVE-2026-46116: use-after-free in xfrm, distros are just now patching it
- CVE-2026-68480: the Safe-RET mitigation has a bug, stable kernels are out
- OpenBSD 7.10: pledge coverage, a W^X gap closed, and DES finally gone
- OpenSSH CVE-2026-60002: the server gets to shoot first
- Debian patched 1,313 kernel CVEs at once. Most are noise. Some aren't.
- Canonical stripped LUKS and LVM out of Ubuntu's GRUB Secure Boot binary. Their own installer defaults to LVM.
- GCC 14 has -fhardened. Stop writing out those nine flags by hand.
- mseal() landed in Linux 6.10. Browsers wanted it. You can use it too.
- OpenPGP's crypto was frozen on a 2007 standard for seventeen years. RFC 9580 ships it in GnuPG stable.
- OpenSSH 10.0 removes DSA entirely. NIST killed it three years ago.
- Two years after PKfail, most affected hardware is still booting on a compromised Secure Boot key
- FreeBSD 14.5 ships: forty-three advisories patched, inotify in base
- CRA day one: the portal is up, the clock is running
- Eighteen years of wrong arithmetic in fragment reassembly: CVE-2026-80590
- Linux 7.2.4, 6.18.50, 6.12.109: SMACK had a use-after-free
- FreeBSD 14.5 is out, EuroBSDCon starts tomorrow
- The EU CRA reporting deadline is Thursday and the portal opens the same morning
- SplitSSHell: a comma in a cert principal has been root in OpenSSH since 2011
- Seven kernel LTS releases drop with USB/IPsec fixes and AI in the commit log
- glibc 2.44 enables FORTIFY_SOURCE=3 by default and your struct tricks are now fatal
- FreeBSD 14.5-RC1 has a sound ioctl UAF and a hardware counter that ignored your credentials
- Linux 7.3-rc1 dropped Saturday. One thousand two hundred and fifty memory management patches.
- Your vulnerability scanner quietly switched sources. The NVD isn't the primary feed anymore.
- OpenSSL 3.0 EOL is two weeks out. If you pinned it, that's your problem now.
- `getrandom()` skips the kernel now. Took long enough.
- OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.
- Linux 7.2 ships. The AI noise finally cleared the kernel's basement.
- Rust in the Linux kernel is not failing. I need to update my priors.
- Unprivileged eBPF is getting locked out by default. It's five years overdue.
- The scary FreeBSD advisory this week isn't an RCE; it's a privilege check that slipped
- "We'll just stay on LTS" stopped being a strategy when LTS became two years
- io_uring keeps producing the same class of CVE and it's time to call that structural
- OpenSSH is finally done pretending your 2009 SSH config was acceptable
- CISA wants a body count on your malloc() calls. They're not entirely wrong.
- Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship
- Go count how many of your dependencies have one maintainer
- The hard part of Rust in the kernel was never the Rust
- The xz backdoor was a social engineering attack and we responded with more scanners