June 2026 Linux Patch Roundup

In June, the Linux ecosystem addressed over 2,913 vulnerabilities across various distributions and products, covering critical issues such as denial of service, privilege escalation, and remote code execution. HiveForce Labs has identified 13 critical vulnerabilities that are either currently being exploited or highly likely to be targeted soon. Notably, one of the vulnerabilities is under active exploitation, requiring immediate attention and remediation.

The most urgent threat is browser-based. CVE-2026-11645, a high-severity out-of-bounds read and write flaw (CVSS 8.8) in V8, the JavaScript and WebAssembly engine, allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page, affecting Chrome prior to 149.0.7827.103 and all Chromium-based browsers including Edge, Brave, Opera, and Vivaldi. It is the fifth actively exploited Chrome zero-day of 2026, with an exploit confirmed in the wild and a fix shipped on June 8, 2026. This is the single vulnerability in this set requiring emergency remediation.

Network-facing services present the highest remote-code-execution risk after the browser. CVE-2024-12084, a heap-based buffer overflow in the Rsync daemon (CVSS 9.8), allows an unauthenticated client to corrupt heap memory through an attacker-controlled checksum length and achieve remote code execution, and it pairs with CVE-2024-12085 (CVSS 7.5), an uninitialized-stack information disclosure flaw that leaks memory to defeat ASLR and make the overflow reliably exploitable; both are resolved in rsync 3.4.0.

CVE-2026-23479, a use-after-free in the Redis unblock-client path, enables code execution as the Redis daemon for an authenticated user with sufficient privileges. CVE-2026-31402, a heap-based buffer overflow in the kernel's NFSv4.0 LOCK replay cache, can be triggered remotely by an unauthenticated attacker using two cooperating NFS clients, most plausibly causing memory corruption and service crash.

Linux kernel and local privilege escalation remain prime targets. CVE-2026-46300, named "Fragnesia," is a local privilege escalation flaw in the kernel's XFRM ESP-in-TCP subsystem (CVSS 7.8); a public proof-of-concept reliably grants root on default installations by modifying a privileged binary such as /usr/bin/su in the page cache, with no race condition required.

CVE-2026-46333, "ssh-keysign-pwn," abuses a missing check in __ptrace_may_access combined with the process-exit window; though scored 5.5 as information disclosure, public exploits demonstrate full local root and theft of sensitive files including OpenSSH host private keys and /etc/shadow. CVE-2025-69720, a stack-based buffer overflow in the ncurses infocmp utility, allows local code execution or crash when processing an untrusted terminfo entry.

Critical flaws in widely deployed application libraries and middleware were also addressed, with real-world impact often gated by configuration. CVE-2026-34444, a sandbox-escape flaw in the Lupa Python-to-Lua bridge (CVSS 10.0), bypasses the attribute filter through built-in functions to reach arbitrary code execution in deployments that execute untrusted Lua with built-ins exposed. CVE-2026-43512, an Apache Tomcat DIGEST authentication bypass (CVSS 9.8, vendor-rated moderate), lets an attacker authenticate as any user where DIGEST authentication is enabled.

CVE-2026-4800, a code-injection flaw in the Lodash template function, executes attacker JavaScript when untrusted input reaches template imports. CVE-2025-52999, a stack-overflow flaw in jackson-core (CVSS 8.7), crashes services through deeply nested JSON, and CVE-2024-4741, a low-severity use-after-free in OpenSSL's SSL_free_buffers, affects only the narrow set of applications calling that function directly.

June 2026's vulnerability landscape reflects continued high-risk trends, with active exploitation of browser engines, publicly weaponized kernel privilege-escalation flaws, and remote code execution in network services and application dependencies posing the most urgent threats. Timely patching, strict configuration hardening, and defense-in-depth strategies remain essential to prevent system compromise.