openwall

A newly disclosed vulnerability, CVE-2026-107891, reveals multiple integer overflows in musl libc's regcomp that can lead to incorrect allocation sizes and out-of-bounds heap writes, disclosed via the Openwall oss-security mailing list.

Hanno Böck discusses recent kernel exploits affecting the ESP (IPSEC) module and suggests disabling IPSEC-related kernel config options to reduce attack surface, highlighting how many unused kernel modules are loaded by default.

A report titled 'Dirty Frag' details a universal Linux Local Privilege Escalation (LPE) vulnerability that allows root access on major distributions by chaining two kernel bugs. The disclosure notes that due to a broken embargo, no patches currently exist for this critical security issue.