# Linux security patch wave continues (June–August 2026) > Live situation record from CLSTR: https://clstr.news/situations/linux-security-vulnerabilities-and-patch-response > Updated: 2026-08-21T05:32:00.000Z. Sources: 30. Developments: 14. The coordinated response that began in late June has expanded into a multi‑month effort to remediate a record‑high volume of Linux‑related flaws. A June bulletin disclosed 1,888 vulnerabilities, including 324 kernel issues and a critical Chromium V8 exploit, prompting Red Hat to issue urgent errata for RHEL 7 ELS and RHEL 8 streams. Early July saw another wave of kernel and component updates from Ubuntu, Red Hat, Debian LTS and others, covering OpenVPN, OpenShift, Vim, nginx, and dozens of CVEs. The most notable discoveries were the Januscape (CVE‑2026‑53359) and GhostLock (CVE‑2026‑43499) kernel bugs, both patched in the mainline kernel after years of exposure and judged high‑severity for cloud-hosted KVM environments. Cloud providers such as Amazon, Google and Microsoft quickly applied the Januscape fix, while Ubuntu released its own kernel update and advised disabling nested virtualization until patched. Mid‑July, enterprise‑focused advisories from Oracle Linux, Red Hat, and Tenable Core added critical updates for kernels, OpenSSH, sudo, Python, Java and other core libraries. By early August, SUSE contributed a critical WebKit2GTK3 fix and a broader set of package patches across the Linux ecosystem, underscoring the sustained, cross‑distribution effort to harden both server and desktop platforms against an expanding threat landscape. Additional developments in late July confirmed the scale of the crisis. Qualys highlighted the RefluXFS race‑condition (CVE‑2026‑64600) in the XFS filesystem, estimating exposure of over 16 million installations and prompting immediate kernel updates from Red Hat, AlmaLinux, Oracle and others. LWN’s July 27‑28 bulletins listed dozens of package updates across AlmaLinux, Debian, Fedora, Mageia, Oracle Linux and Red Hat, extending the patch cadence. In mid-August, new kernel vulnerabilities emerged that threaten host isolation. Zapscape (CVE-2026-64561) was identified in the KVM hypervisor, where a stale-root check ordering flaw could allow a guest virtual machine to execute code on the host. ## Claims - CVE‑2026‑64600 (RefluXFS) is a Linux kernel XFS race condition that allows local privilege escalation to root. (single source) - RefluXFS may affect over 16.4 million systems, including RHEL, Oracle Linux, Amazon Linux and Fedora. (single source) - AlmaLinux 10 security update ALSA‑2026:44270 patches CVE‑2026‑46323, a use‑after‑free vulnerability in the net/gro subsystem. (single source) - AlmaLinux 9 bug‑fix ALBA‑2026:39332 resolves XFS reflink data‑corruption in version 9.8.z. (single source) - Multiple Linux distributions released security updates for dozens of packages, including kernel, OpenSSL, Java, and various system utilities. (single source) - CVE‑2026‑50458 is a use‑after‑free vulnerability in the Windows bfs.sys driver that can enable privilege escalation. (single source) - The Windows bfs.sys vulnerability was patched in the latest Patch Tuesday release. (single source) - Major Linux distributions released critical patches for the Linux kernel, glibc, OpenSSH, Node.js, and OpenSSL in week 31, 2026. (single source) - Qubes OS addressed four Xen vulnerabilities (XSA-500, XSA-505, XSA-506, XSA-507) that could allow malicious VMs to escape isolation. (single source) - Ubuntu rolled out specialized cloud kernel updates for Azure, AWS, and Oracle environments. (single source) - Arch Linux released an August ISO featuring Linux kernel 7.1.5. (single source) - Linux desktop market share surpassed 10% in North America. (single source) ## Timeline ### 2026-08-21: Linux distributions release critical security patches for kernels and infrastructure Major Linux distributions including Ubuntu and Debian have released critical security patches for kernels, cloud infrastructure, and runtime tools like Redis and Podman to address remote execution and escapeRis 2 sources. https://clstr.news/cluster/linux-distributions-release-critical-security-patches-for-kernels-and-infrastructure ### 2026-08-15: openSUSE releases Leap 16 amid major Linux security updates openSUSE has launched Leap 16 for various platforms while SUSE issues critical security patches for Chromium, Dracut, and the Linux kernel to address multiple vulnerabilities. 2 sources. https://clstr.news/cluster/opensuse-releases-leap-16-amid-major-linux-security-updates ### 2026-08-10: Linux kernel vulnerabilities Zapscape and SCTPhantom enable host escape New Linux kernel vulnerabilities, Zapscape and SCTPhantom, allow attackers to escape virtual machine or container isolation to gain host-level control via use-after-free flaws. 8 sources. https://clstr.news/cluster/linux-kernel-vulnerabilities-zapscape-and-sctphantom-enable-host-escape ### 2026-08-06: Zapscape KVM Vulnerability (CVE‑2026‑64561) Threatens Linux Hosts Zapscape (CVE‑2026‑64561) is a critical KVM shadow‑MMU bug that lets a privileged guest VM escape to the host Linux kernel, affecting cloud and HPC environments; patches are urgently needed. 2 sources. https://clstr.news/cluster/zapscape-kvm-vulnerability-cve202664561-threatens-linux-hosts ### 2026-08-03: SUSE issues critical WebKit2GTK3 security update and multiple Linux package patches SUSE released a critical WebKit2GTK3 security patch and several moderate updates for openSUSE packages, while LWN.net reported a wide‑range of security updates across major Linux distributions on 4 Aug 2026. 3 sources. https://clstr.news/cluster/suse-issues-critical-webkit2gtk3-security-update-and-multiple-linux-package-patches ### 2026-07-30: Linux Distributions Deploy Massive Security Patches in Week 31, 2026 Linux distributions issued critical patches for kernel, glibc, OpenSSH, Node.js, OpenSSL and more in week 31, 2026, with Ubuntu adding cloud‑kernel updates and Qubes OS fixing Xen vulnerabilities. 5 sources. https://clstr.news/cluster/linux-receives-security-patches-and-software-updates-in-week-31-2026 ### 2026-07-28: Linux security updates released for Tuesday and Wednesday LWN.net released Tuesday and Wednesday security bulletins with numerous package patches for major Linux distributions, dated late July 2026. 2 sources. https://clstr.news/cluster/linux-security-updates-released-for-tuesday-and-wednesday ### 2026-07-26: Critical Linux Kernel Flaw RefluXFS Exposes Millions of Systems Qualys disclosed a critical Linux XFS race‑condition (CVE‑2026‑64600) affecting millions, prompting kernel patches from AlmaLinux and other distros, while a Windows bfs.sys use‑after‑free (CVE‑2026‑50458) was也已 6 sources. https://clstr.news/cluster/almalinux-issues-critical-kernel-security-patch-for-cve202646323 ### 2026-07-21: Enterprise Linux Distributions Issue Major 2026 Security Updates Tenable Core and Red Hat issue extensive 2026 security updates for Oracle Linux and RHEL, covering kernels, libraries and key enterprise tools. 2 sources. https://clstr.news/cluster/enterprise-linux-distributions-issue-major-2026-security-updates ### 2026-07-15: Linux kernel Januscape vulnerability threatens global data centers A 16‑year‑old Linux kernel flaw called Januscape lets a VM escape its host, risking data‑center breaches; major cloud providers have patched it. 3 sources. https://clstr.news/cluster/linux-kernel-januscape-vulnerability-threatens-global-data-centers ### 2026-07-11: Security patches roll out for Windows DWM and Ubuntu Linux kernel privilege‑escalation bugs Patches for Windows DWM (CVE‑2026‑20871) and Ubuntu Linux kernel (CVE‑2026‑53359) mitigate local privilege‑escalation bugs; Windows fixes include micropatches for legacy versions, Ubuntu advises disabling KVM‑n 2 sources. https://clstr.news/cluster/security-patches-roll-out-for-windows-dwm-and-ubuntu-linux-kernel-privilegeescalation-bugs ### 2026-07-09: Linux KVM “Januscape” VM Escape and GhostLock Vulnerabilities Patched Critical Linux kernel bugs—Januscape VM escape (CVE‑2026‑53359) and GhostLock privilege escalation (CVE‑2026‑43499)—have been patched after years of existence; upgrades are urged to protect cloud hosts. 4 sources. https://clstr.news/cluster/linux-kernel-patches-address-highseverity-vulnerabilities ### 2026-07-03: Linux Distributions Release Critical Security Patches Ubuntu, Red Hat and Debian released extensive kernel, OpenVPN, nginx and other Linux security patches to fix hundreds of vulnerabilities. 2 sources. https://clstr.news/cluster/linux-distributions-release-critical-security-patches ### 2026-06-28: Linux and Red Hat security updates expose record 1,888 vulnerabilities June’s Linux patch bulletin listed a record 1,888 flaws, including an actively exploited Chromium bug, while Red Hat released important updates for perl‑IO‑Compress and libxslt on RHEL 7/8. 2 sources. https://clstr.news/cluster/linux-and-red-hat-security-updates-expose-record-1888-vulnerabilities --- Cite as: Linux security patch wave continues (June–August 2026). CLSTR, https://clstr.news/situations/linux-security-vulnerabilities-and-patch-response