August 2026 Linux Patch Roundup

In August, the Linux ecosystem addressed over 3,361 vulnerabilities across major distributions and products, spanning issues from information disclosure to privilege escalation to remote code execution. HiveForce Labs has identified nine critical vulnerabilities that are either currently being exploited or highly likely to be targeted soon. Three of these are already under active exploitation, requiring immediate remediation.

The most urgent threats are unauthenticated, network-reachable code-execution flaws already being abused in the wild. CVE-2026-77647, a critical code-injection vulnerability (CVSS 9.8, CWE-94) in the SPIP content management system, allows a remote, unauthenticated attacker to execute arbitrary code on the server through a crafted request and is confirmed exploited in the wild as of August 2026. It is fixed in SPIP 4.4.20 and is the clearest emergency-remediation case in this set.

Alongside it, CVE-2026-60137, tracked as wp2shell, is a critical SQL injection flaw (CVSS 9.1) in WordPress core's WP_Query author__not_in handling that chains to full remote code execution by forging a malicious administrator account. Exploitation has been observed since mid-July, affects the single largest web-application footprint on the internet, and is resolved in WordPress 6.9.5, 7.0.2, and 6.8.6.

Other network-facing services present the next tier of remote-code-execution risk even where in-the-wild abuse has not yet been confirmed. CVE-2026-4631, an unauthenticated argument-injection flaw in Cockpit (CVSS 9.8), lets a remote attacker smuggle attacker-controlled options into an SSH invocation and achieve command execution against Cockpit 327 and later fronted by OpenSSH earlier than 9.6. It is fixed in Cockpit 360.

CVE-2026-66066, KindaRails2Shell, is a critical Ruby on Rails Active Storage flaw (CVSS 9.5) in which an attacker-supplied image drives libvips to read arbitrary files, recovering the application's signing secrets and pivoting to unauthenticated remote code execution. A public proof-of-concept and a Metasploit module already exist, and Debian, Ubuntu, and default Rails container images are exposed out of the box. It is fixed in Rails 7.2.3.2, 8.0.5.1, and 8.1.3.1 with libvips 8.13 or later, and all secrets the application can read should be rotated.

The Linux kernel remains the primary target for local privilege escalation, and this month's set is unusually deep. CVE-2026-31431, Copy Fail, is a memory-corruption flaw in the kernel's algif_aead (AF_ALG) crypto interface that grants root from an unprivileged local context. It is already under active exploitation and carries added weight in containerized environments.

CVE-2026-64600, RefluXFS, is a race condition in the XFS reflink copy-on-write path that overwrites a protected file such as /etc/passwd or a SUID-root binary directly in the block layer to obtain root. It is especially dangerous because exploitation produces no kernel log output and is not blocked by SELinux in enforcing mode, and because XFS reflink is the default on Red Hat Enterprise Linux and its derivatives. CVE-2026-64564, SCTPhantom, is an 18-year-old use-after-free in the kernel's SCTP ASCONF handling that yields both local privilege escalation and container escape.

CVE-2026-64531, OVSwrap, abuses unprivileged user namespaces to auto-load the Open vSwitch kernel module and corrupt nested-attribute handling, causing kernel memory corruption and denial of service. CVE-2026-43494, PinTheft, chains a double-free in the kernel's RDS sockets with io_uring to overwrite a privileged binary's page cache and escalate to root. RefluXFS, SCTPhantom, OVSwrap, and PinTheft all carry public proof-of-concept code but are not yet confirmed exploited in the wild.

August 2026's vulnerability landscape reflects continued high-risk trends, with active exploitation of internet-facing web applications, weaponized kernel privilege-escalation flaws, and unauthenticated remote code execution in network services and application dependencies posing the most urgent threats. Timely patching, strict configuration hardening, and defense-in-depth strategies remain essential to prevent system compromise.