wsl2 security

CVE-2026-64600 is a newly published Linux kernel vulnerability in XFS that turns a subtle copy-on-write race into a potentially serious local privilege-escalation and data-integrity problem on systems using reflink-enabled XFS filesystems. The bug, publicly discussed as RefluXFS, affects the...

CVE-2026-64036 is a newly published Linux kernel vulnerability that illustrates a familiar but increasingly important eBPF security lesson: a narrow validation mistake at the boundary between privileged kernel code and programmable observability tooling can create a serious local attack surface...

CVE-2026-64077 is a newly published Linux kernel vulnerability in the legacy ebtables portion of Netfilter, and it matters to Windows users chiefly through the Linux systems that now sit beside, beneath, and sometimes inside Windows: WSL 2 distributions, container hosts, developer workstations...

CVE-2026-53400 addresses a long-standing race in the Linux I2C core that can expose partially initialized I2C adapter objects to other kernel code, potentially causing NULL-pointer dereferences or use-after-free conditions. The flaw has now been published in the NVD and assigned fixes in Linux...

CVE-2026-63829 closes a Linux kernel authorization flaw that can let a process holding CAP_NET_ADMIN in one network namespace alter an IP GRE or ERSPAN tunnel associated with a different namespace. For Windows administrators, the immediate exposure is concentrated in WSL 2, Linux container...

CVE-2026-63826 is a newly published Linux kernel use-after-free flaw in the legacy framebuffer subsystem, with fixes now identified in Linux 6.6.144, 6.12.95, 6.18.38, and 7.1.3. The issue is not a Windows host vulnerability, but it matters to Windows administrators and developers running Linux...

CVE-2026-31431 does not prove that Microsoft’s WSL2 kernel update path is inherently too slow for enterprise use. It does prove that enterprises can no longer treat WSL as an incidental Windows feature: Store-serviced WSL is defensible only when its independent update channel is allowed...

Microsoft has issued a fix for CVE-2026-57973, a Windows Subsystem for Linux 2 vulnerability that could let a locally authorized attacker tamper with data through a race condition in the WSL2 environment. The affected WSL package range is version 5.0.0.0 through versions earlier than 2.7.10...

Microsoft has patched CVE-2026-57968, a high-severity local elevation-of-privilege flaw in Windows Subsystem for Linux 2, by shipping WSL version 2.7.8 and later. The advisory, published July 14, 2026, identifies a buffer over-read that can let an authorized attacker elevate privileges locally...