Linux Kernel Privilege Escalation: A Multi-Distribution Crisis

CISA added two Linux Kernel entries that together represent a systemic risk across virtually every Linux-dependent workload in federal and commercial environments.

CVE-2026-53362 — a newly cataloged vulnerability in the Linux Kernel's IPv6 networking subsystem — enables privilege escalation and explicitly impacts distributions including SUSE and Red Hat, with the advisory noting additional products may be affected. The deadline is August 30, giving teams this weekend to act. Because IPv6 is enabled by default on most modern Linux deployments and is often left unmonitored relative to IPv4 traffic, this attack surface is broader than many teams currently model. Organizations that cannot patch immediately should assess whether disabling IPv6 is operationally feasible as a temporary mitigation and should prioritize patching on any internet-facing or multi-tenant systems first.

CVE-2022-0995 — a Linux Kernel out-of-bounds memory write vulnerability cataloged earlier — carries a deadline of September 9. Local users can leverage this to gain privileged access or trigger denial of service. While local access is required, this class of vulnerability is routinely chained with initial access techniques in post-exploitation sequences. Treat this as a privilege escalation enabler in your threat models, not a standalone low-severity finding. Distribution-specific patches from Red Hat, SUSE, Ubuntu, and Debian are available; confirm your kernel version and apply the appropriate update.

Developer Toolchain and Legacy Software: Long-Deferred Debt Comes Due

Three entries in this cycle target the software supply chain and development infrastructure, and two of them involve software that may already be end-of-life in your environment.

CVE-2026-66384 (JFrog Artifactory) is a path traversal vulnerability allowing authenticated users to write data outside the intended Docker cache path under specific remote-repository conditions. With a deadline of September 10, this is the furthest out in this cycle, but it demands immediate attention in any environment where Artifactory serves as a central artifact registry. A compromised artifact path in a CI/CD pipeline can propagate malicious content downstream to build systems and production deployments. Upgrade Artifactory and audit remote repository configurations for anomalous write activity.

CVE-2021-23758 (Ajax.NET Professional) exposes a critical deserialization of untrusted data vulnerability enabling remote code execution via arbitrary .NET class instantiation. AjaxPro is explicitly flagged as potentially end-of-life. The path forward here is not patching — it is removal or replacement. Any application surface still running AjaxPro should be inventoried immediately, and development teams should plan accelerated migration to supported .NET frameworks. Deadline: September 9.

The two Red Hat entries — CVE-2015-3246 (Libuser, race condition enabling /etc/passwd corruption and privilege escalation) and CVE-2015-5287 (ABRT, symlink attack enabling privilege escalation) — are over a decade old. Their addition to KEV in 2026 signals confirmed, active exploitation. ABRT is flagged as potentially end-of-life; discontinuation is the recommended path. For Libuser, apply available patches from Red Hat and assess whether the affected system configurations align with current hardening baselines. Deadline for both: September 9.

Operational Posture Summary

| CVE | Product | Deadline | Key Risk | |---|---|---|---| | CVE-2019-1068 | MS SQL Server | Aug 29 | RCE via DB Engine service account | | CVE-2023-49105 | ownCloud | Aug 30 | Unauthenticated file access/deletion | | CVE-2026-53362 | Linux Kernel | Aug 30 | Privilege escalation via IPv6 | | CVE-2015-3246 | Red Hat Libuser | Sep 9 | passwd corruption, local privesc | | CVE-2015-5287 | Red Hat ABRT | Sep 9 | Symlink-based local privesc (EoL) | | CVE-2021-23758 | Ajax.NET Pro | Sep 9 | RCE via .NET deserialization (EoL) | | CVE-2022-0995 | Linux Kernel | Sep 9 | Out-of-bounds write, local privesc | | CVE-2026-66384 | JFrog Artifactory | Sep 10 | Path traversal in artifact registry |

Federal contractors: BOD 26-04 compliance is mandatory. Document compensating controls for any asset where patch deadlines cannot be met and escalate through your authorizing official chain without delay.

Sources: CISA KEV Catalog · CISA BOD 26-04 · Microsoft SQL Server Security Advisory CVE-2019-1068 · ownCloud Security Advisory CVE-2023-49105 · JFrog Artifactory Security Bulletins · Red Hat Security Advisory: Libuser · Red Hat Security Advisory: ABRT · Linux Kernel Security · CISA Forensics Triage Guidance