Two high-severity remote code execution bugs in the Linux KSMBD kernel module have been disclosed publicly, leaving servers without a confirmed fix in the mainline kernel.
A guest-triggerable bug in Linux KVM allows bypassing write tracking via stale SMM MMIO cache entries, potentially letting a virtual machine modify backing pages without detection.
Attackers modified Bash startup files to intercept sudo commands and steal passwords from government and infrastructure targets, according to Unit 42 research.