Threat Advisory • Vulnerability Report

July 2026 Linux Patch Roundup

In July, more than 3,627 new vulnerabilities were discovered and addressed within the Linux ecosystem, impacting Debian, Red Hat, OpenSUSE, and Ubuntu. HiveForce Labs has identified 11 severe vulnerabilities that are exploited or have a high potential of successful exploitation, led by two Linux kernel zero-days, GhostLock (CVE-2026-43499) and Bad Epoll (CVE-2026-46242), both of which grant full root control.

01 / Overview

Summary

In July, more than 3,627 new vulnerabilities were discovered and addressed within the Linux ecosystem, impacting several major distributions such as Debian, Red Hat, OpenSUSE, and Ubuntu. During this period, over 433 vulnerabilities were also highlighted, with corresponding hotfixes or patches released to resolve them. These vulnerabilities span from information disclosure to privilege escalation to code execution. HiveForce Labs has identified 11 severe vulnerabilities that are exploited or have a high potential of successful exploitation, necessitating immediate attention. To ensure protection, it is essential to upgrade systems to the latest version with the necessary security patches and appropriate security controls.

The month's threat distribution spans Code Execution, Denial of Service, Information Disclosure, and Unauthorized Access, with adversary tactics touching Initial Access, Execution, Privilege Escalation, Impact, and Collection.

CVEs at a Glance

* Refers to Notable CVEs — vulnerabilities that are either exploited in zero-day attacks, included in the CISA KEV catalog, utilized in malware operations, or targeted by threat actors in their campaigns.

02 / Vulnerability Details

Vulnerability Details

#1 — Scale of July's Linux Ecosystem Disclosures

In July, the Linux ecosystem addressed over 4,060 vulnerabilities across various distributions and products, covering critical issues such as information disclosure, denial-of-service, and code execution. Over 3,627 new vulnerabilities were discovered and patched. HiveForce Labs has identified 11 critical vulnerabilities that are either currently being exploited or are highly likely to be exploited in the near future.

#2 — Adversarial Tactics Enabled

These vulnerabilities could facilitate adversarial tactics such as Initial Access, Execution, and Privilege Escalation. Notably, three of these vulnerabilities — GhostLock, Bad Epoll, and the LiteLLM command injection flaw — are currently being exploited, requiring urgent attention and remediation.

#3 — GhostLock (CVE-2026-43499): A 15-Year-Old Linux Kernel Bug

GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel bug that lets any logged-in user seize full root control of a machine. The flawed code has shipped by default in nearly every major Linux distribution since 2011. GhostLock is also the second half of an exploit chain called IonStack. The first half, CVE-2026-10702, is a Firefox flaw that runs code inside the browser and breaks out of its sandbox; GhostLock then carries the attacker the rest of the way to root.

#4 — Bad Epoll (CVE-2026-46242): Another Root-Granting Kernel Flaw

Bad Epoll (CVE-2026-46242) is another Linux kernel flaw that lets a regular user with no special access take over a machine as root. It affects Linux desktops, servers, and Android, and a patch is available. Epoll is a core Linux feature that lets a program monitor many files or network connections at once. Servers, network services, and web browsers all depend on it, so it can't simply be turned off.

#5 — CVE-2026-42271: Command Injection in BerriAI LiteLLM

CVE-2026-42271 is a command injection flaw in LiteLLM that lets any authenticated user run arbitrary commands on the host. A successful attack could let intruders execute commands on the LiteLLM server, steal model-provider credentials, harvest API keys and secrets held by the proxy, pivot into connected AI infrastructure, and compromise downstream systems linked to the gateway.

#6 — CVE-2026-13774: Use-After-Free in Chrome Extensions

CVE-2026-13774 is a use-after-free flaw in Google Chrome's Extensions component. The root cause is poor object lifetime management: a pointer to an extension-related object stays reachable after the object has been destroyed, so a later operation ends up reading or writing freed memory.

Notable CVEs — Celebrity Vulnerabilities

03 / Recommendations

Recommendations

Proactive Strategies

Reactive Strategies

04 / Detect, Mitigate & Patch

Detect, Mitigate & Patch

05 / MITRE ATT&CK

Potential MITRE ATT&CK TTPs

06 / References

References

• lore.kernel.org/linux-cve-announce/
• github.com/leonov-av/linux-patch-wednesday
• www.debian.org/security/#DSAS
• lists.ubuntu.com/archives/ubuntu-security-announce/
• access.redhat.com/security/security-updates/
• lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/
• nebusec.ai/research/ionstack-part-2/
• www.hivepro.com/threat-advisory/bad-epoll-linux-kernel-eventpoll-use-after-free-enables-local-root
• github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499