New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
PSA: Prepare for another emergency reboot (CVE-2026-64560)
Thankfully this is not a KVM escape so nodes won't have to reboot as fast, but the guests sure should.
The bug, CVE-2026-64560, is a UAF in the POSIX timer subsystem, and allows rather simple privilege escalation.
See detailed description in commit 920f893f735e92ba3a1cd9256899a186b161928d.
Unfortunately, there's not even a fix in Debian yet (besides Sid), but see their security tracker for updates.
Comments
great success--every day
AI really fucked things up
fuck
This kind of LPE happens regularly in Linux and it's why you can't use Docker as a security boundary. You would have to have already escaped a VM to use this against a VM host.
Is a full reboot actually necessary even if I use LivePatch to keep the kernel up to date with security patches?
The RHEL errata classifies this (for now) as moderate severity and states that it does not affect RHEL 7.x and 8.x.
But there's also this shit (OVSwrap, CVE-2026-64531):
https://blog.cloudlinux.com/ovswrap-cve-2026-64531-mitigation/
It is becoming a new reality, so all we can do it to accept it and continue to live [preferably happily].
FUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUCKKKKKKKKKKKKKKKK
Fucked up and down.
And sideways too.
Ha, OpenVSwitch! That used to be such a pain in my side!!
I think it got a lot better over the years. Now it bites again.
A one-liner to solve all the problems:
for H in $(awk '$1=="Host"{print $2}' .ssh/config); do ssh $H 'sudo apt update && sudo apt full-upgrade -y && sudo reboot'; done-sh: sudo: not found
-sh: apt: not found
No salvation!
Oh well, the bazaar at work.
Happens with the Cathedral as well.
Much less though.
Fewer discoveries != fewer vulns. A few years ago a study was done which showed that Linux, while more bugs were reported, was overall harder to exploit than FreeBSD or even OpenBSD (the kernels specifically, not the userspace), and that bugs typically got fixed faster.
and we not mentioning Windows... OoPs.
...Emergency reboot: because "have you tried turning it off and on again" apparently still scales to enterprise...
I take it that you are a linux fan. No problem but not a good basis for certain topics. Just a few remarks
Let's end this here, I like and respect you (even though you obviously are a linux fan and in the bazaar camp *g) and I have no interest in creating, let alone in hardening fronts between us.
Have a nice weekend
Oh, I don't know...Oracle released fixes for 1,449 security vulnerabilities in its products this quarter.
https://www.theregister.com/security/2026/07/23/oracle-drops-1449-security-patches-like-its-the-new-normal/5277114
@jsg I have a more nuanced view than you might think, and I use and enjoy both!
I'm actually not a Linux fan. While I suppose I could say I'm "team Linux" in that it's what I use the most, I've never felt more "welcome" as when I use OpenBSD. Everything fits together perfectly. The manpages are actually useful (besides man2 at least) and I don't have to install that god-awful GNU Info package just to see more information about a simple coreutils command. As for FreeBSD, I do have issues with it regarding lack of security mitigations (it's ASLR is weak and it's still vulnerable to SROP after all these years), but it's certainly not a bad system.
Oh I agree. I far prefer the OpenBSD userspace (and general development practices). I'm only talking about the kernel. The OpenBSD userspace is better than the Linux userspace, even if only because of the ubiquitous use of
pledge()and the fact that their memory allocator is designed with security in mind.The reason I only compare kernels is because of the vast difference in Linux distros. Debian is definitely going to be less secure than OpenBSD so would that be a fair comparison? Or I could choose a customized, locked-down Gentoo install but that would sway things in favor of Linux. So instead I only look at the kernels when I make comparisons about security.
What matters at the end of the day is how hard it is to exploit a properly-configured system.
The kernel? Yes. Even pre-LLM, just run a syscall fuzzer on OpenBSD and you'll faint.
See also https://isopenbsdsecu.re/, which is generally considered accurate by exploit developers.
That doesn't mean that the average Linux system will be more secure than the average OpenBSD system, of course. The average Linux system is some crappy IoT device that hasn't seen an update in 7 years. The average OpenBSD system is probably a well-looked after firewall managed by a seasoned sysadmin.
Don't get me wrong, while I like Linux, it has a lot of faults. Now, I am a diehard FOSS fan (with only a slight preference for GPL but nothing against BSD). But as for Linux vs *BSD? There's a lot of nuance and I can't say one is better in all ways. They all have their place and the world would be worse off if it lost any of them.
What's next? Microsoft?
Besides what's that to do with linux or the BSDs?
I largely agree and am not surprised that you are more nuanced than it seemed at first glance.
One point though I'd like to pick out and underline:
One more reason to prefer BSD *g
That said one doesn't always have the free choice. I myself am using linux on my workstation, not because I like it but because it's less evil and crappy than Windows.
On my servers though, BSD only.
My point was to compare cathedral vs. bazaar. Oracle is as cathedral as you can get. The cathedral/bazaar model isn't limited to open source, is it? You can label closed-source projects/products as having cathedral-style development I think.
Closed-source products are pretty much locked into being Cathedral-style, unless they simply take a permissively-licensed product, close it, and release it without doing any real development themselves I suppose.
yes. it seems so.
Unless they release a livepatch specifically to fix this, which I don't believe they have.
OK, my bad, I should have made it clear that IMO pretty much every large corp is outside that pattern. Also the cathedral of course also need good people at the top.
Besides, Oracle seems to be mostly in the ai and DC business (and with a bit of luck belly up soon).