A 9.8 kernel-level RCE in Linux ksmbd and 4 more you should know about

ksmbd, the in-kernel SMB3 server in Linux, has an out-of-bounds write bug in its extended-attribute handling (smb2_get_ea). An attacker who can reach the SMB service could potentially get remote code execution at kernel level with no authentication. CVSS 9.8 says it all: if you expose ksmbd to any network, this is a top-priority fix.

Affected estate

Anyone running Azure Linux 3.0 with the ksmbd kernel module enabled, or any Linux host using ksmbd for SMB file sharing

How to check

Run `uname -r` to check kernel version, then `lsmod | grep ksmbd` to confirm the module is loaded.

Included because

unauthenticated; network-reachable; kernel-level RCE; CVSS 9.8

Action

Update to the patched kernel package and reboot, or unload ksmbd immediately if it is not needed.

Why it matters

This is an unauthenticated remote kernel-level write, so exploitation gives full system control.

Source

NVD

A vulnerability in FRR (Free Range Routing) affects Azure Linux 3.0 and CBL Mariner 2.0 packages. Details are sparse, but the CVSS 7.5 score and the affected product (a network routing daemon) suggest a remotely triggerable crash or information leak. If you run FRR on these platforms, treat this as a network-facing risk until more detail lands.

Affected estate

Teams running FRR on Azure Linux 3.0 (frr 10.5.0-2) or CBL Mariner 2.0 (frr 8.5.5-5)

How to check

Run `rpm -q frr` or `tdnf list installed frr` to confirm the installed version.

Included because

network-facing service; CVSS 7.5; common routing daemon on Azure infrastructure

Action

Update frr via tdnf or your package manager to the patched release.

Why it matters

FRR handles BGP, OSPF, and other routing protocols. A remotely exploitable bug in a routing daemon can disrupt your entire network fabric.

Source

NVD

During installation of Norton Secure VPN from the Microsoft Store, a low-privilege local user can swap out files in the install path. That lets them delete arbitrary files and escalate to higher privileges. This requires local access and the timing window of an active installation, so it's not remotely exploitable, but any shared workstation where Norton Secure VPN gets deployed is at risk.

Affected estate

Windows endpoint teams deploying Norton Secure VPN via the Microsoft Store, especially on shared or multi-user machines

How to check

Check installed apps via Settings > Apps or query `Get-AppxPackage *Norton*` in PowerShell.

Included because

local privilege escalation; CVSS 8.8; common endpoint VPN product

Action

Update Norton Secure VPN to the latest version. Pause rollout on multi-user machines until patched.

Why it matters

A low-privilege user on a shared machine can escalate to full control by exploiting the install window.

The Skylight Workspace Config Service in Amazon WorkSpaces for Windows has a flaw in its log rotation. A local non-admin user can plant arbitrary files in arbitrary locations, bypassing file system permissions, and escalate all the way to SYSTEM. You need local access, but no admin rights, so this is a real concern on any WorkSpaces desktop.

Affected estate

Teams running Amazon WorkSpaces for Windows with the Skylight Workspace Config Service older than version 2.6.2034.0

How to check

Check the installed version of the Skylight Workspace Config Service in Programs and Features or by querying the service binary's file version.

Included because

local privilege escalation to SYSTEM; no admin rights needed; CVSS 7.8; common VDI product

Action

Push the updated WorkSpaces agent (2.6.2034.0+) through your WorkSpaces management console or update pipeline.

Why it matters

Any non-admin user on a WorkSpaces desktop can escalate to SYSTEM, giving them full control of the virtual desktop and any data on it.