u/michaelpaoli

▲ 18 r/dns

Pre-announcement of BIND 9 security issues scheduled for disclosure 20 May 2026

I might also update this after the announcement is out.

Anyway, once it's out, also expect updated/patched versions of BIND 9 to shortly follow for various operating systems, "appliances", devices, etc.

https://lists.isc.org/pipermail/bind-announce/2026-May/001294.html

>From: Victoria Risk <vicky@isc.org>
Subject: Pre-announcement of BIND 9 security issues scheduled for disclosure 20 May 2026
Date: Wed, 13 May 2026 09:34:22 -0400
To: bind-announce@lists.isc.org

BIND users

As part of ISC's policy of pre-notification of upcoming security releases, we are writing to inform you that the May 2026 BIND 9 maintenance release(s) that will be published on Wednesday, 20 May, will contain fixes for security vulnerabilities affecting stable BIND 9 release branch(es).

Further details about those vulnerabilities will be publicly disclosed at the time the release(s) are published. It is our hope that this pre-announcement will aid BIND 9 administrators in preparing for that disclosure when it occurs. If you have feedback or questions concerning this policy, please open a confidential GitLab issue at https://gitlab.isc.org/isc-projects/bind9/-/issues/new?issue[confidential]=true (preferred) or send an email to bind-security@isc.org.
--
bind-announce mailing list
bind-announce@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-announce

reddit.com
u/michaelpaoli — 5 days ago
▲ 83 r/debian

CVE-2026-31431 CVSS score 7.8 Severity High Linux kernel (apparently easy local root exploit)

Apparently updates/"patches" underway:
https://security-tracker.debian.org/tracker/CVE-2026-31431

Meantime, apparently workarounds:

>disable the algif_aead kernel module. This breaks nothing for the vast
majority of systems  dm-crypt, LUKS, IPsec, TLS, SSH, and standard
OpenSSL/GnuTLS builds all use the in-kernel crypto API directly and do
not go through AF_ALG:
echo 'install algif_aead /bin/false' >/etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
For containerized or multi-tenant workloads, block AF_ALG socket
reation via seccomp policy regardless of patch state.

Proof-of-concept exploit already published, likely expect active exploit
attempts soon, if they've not already started.

Looks like the bug has been in Linux kernels for about 9 years.

Select references:
https://www.cve.org/CVERecord?id=CVE-2026-31431
https://www.cyberkendra.com/2026/04/a-732-byte-python-script-can-get-root.html

reddit.com
u/michaelpaoli — 23 days ago