Vulnerabilities
Linux Kernel OpenvSwitch Race Condition Enables Local Privilege Escalation (CVE‑2026‑74465)
A race condition in the Linux kernel’s OpenvSwitch dp_meter handling allows local attackers to gain root privileges after executing low‑privileged code. The flaw is fixed in a kernel commit and requires immediate patching. Defenders should update kernels, audit OpenvSwitch usage, and monitor for suspicious dp_meter activity.
What Happened
A race condition in the Linux kernel’s OpenvSwitch dp_meter objects permits a local attacker to elevate privileges. The flaw stems from missing locking during dp_meter operations, enabling arbitrary kernel‑mode code execution.
Impact
CVSS score 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Affected systems run any Linux kernel version that includes the vulnerable OpenvSwitch implementation. Successful exploitation results in root access and full control of the host.
Mitigation
Apply the kernel update containing commit a58a2b0ce354df531ebc71fc870058c2feb59f6b. The patch restores proper locking around dp_meter operations. Verify kernel version with uname -r and update via your distribution’s package manager.
What to Do
- Patch all affected hosts immediately.
- Audit OpenvSwitch configurations and limit local code execution privileges.
- Monitor for anomalous dp_meter activity and kernel panics.
- Implement least‑privilege controls for processes interacting with OpenvSwitch.
Related vulnerabilities
Linux Kernel eMPIA USB Driver Race Condition Enables Kernel Code Execution (CVE‑2026‑31583)
A race condition in the Linux kernel’s eMPIA USB device driver allows a physically present attacker to execute arbitrary code in kernel context without authentication. The flaw, rated CVSS 7.1, stems from missing locking on em28xx_v4l2 structures. Defenders should apply the kernel patch (commit a66485a934c7187ae8e36517d40615fa2e961cff) or update to a patched distribution version and consider disabling unused USB devices.
Read briefing
CVE-2026-70104: Windows Win32k Privilege Escalation Vulnerability
A local privilege escalation flaw in the Windows Win32 kernel subsystem allows an authenticated user to gain elevated rights by dereferencing an untrusted pointer. Microsoft has issued a patch; defenders should update systems immediately and verify that the kernel component is patched.
Read briefing
CVE-2026-70114: Windows Kernel Heap Overflow Enables Local Privilege Escalation
Microsoft has identified a heap-based buffer overflow in the Windows kernel that allows an authorized local user to gain SYSTEM privileges. The vulnerability affects Windows 10, 11, and Windows Server 2016/2022. Defenders should apply the latest cumulative update and enforce least‑privilege controls.
Read briefing
CVE-2026-70108: Windows Win32k Heap Overflow Enables Local Privilege Escalation
Microsoft disclosed CVE‑2026‑70108, a heap‑based buffer overflow in the Win32 kernel subsystem that lets an authenticated local user elevate privileges. The flaw is present in all current Windows releases until patched. Defenders should apply the latest cumulative update and monitor for anomalous privilege changes.
Read briefing