Projfs Vulnerability
The latest Projfs Vulnerability coverage — news, analysis, and updates from the WindowsNews.AI desk.
Critical ServiceNow RCE Flaws Under Active Attack: What Users Must Do Now
ServiceNow users are facing active attacks targeting two critical unauthenticated RCE flaws, CVE-2024-4879 and CVE-2024-5217. CISA added both to its Known Exploited Vulnerabilities catalog in July 2024, confirming exploitation. This article explains who is affected, the patch levels required, and step-by-step actions for hosted, self-hosted, and partner-managed deployments to secure their instances immediately.
Screenshot Block for Protected PDFs Arrives on OneDrive Web Next Month—But There's a Browser Catch
Microsoft will enforce screenshot blocking for PDFs with Purview sensitivity labels that deny copy permissions when viewed through OneDrive or SharePoint in Edge, starting August 2026. Other browsers and mobile are unsupported, making Edge the only compliant viewer. IT admins must review label configurations, browser policies, and user training to avoid disruptions.
CVE-2026-63794: Linux KVM Host Bug Exposes AMD SEV-Protected Windows VMs to Memory Overflow
A buffer overflow vulnerability in Linux KVM's AMD SEV code, tracked as CVE-2026-63794, can compromise the memory encryption that protects virtual machines, including Windows guests. While Windows updates won't fix it, host administrators must patch their Linux KVM servers with a kernel version that includes the fix (e.g., 5.10.260 or later), and then reboot. Cloud customers should verify their provider has addressed the issue; on-prem admins have clear steps to patch and verify.
Realtek Wi-Fi Memory Leak Patched in Linux: What Windows Users Need to Know
A memory leak in the Linux kernel's Realtek rtw88 USB Wi-Fi driver has been patched in the latest stable kernel updates. While the flaw, tracked as CVE-2026-63821, can lead to system memory exhaustion under specific conditions, it does not affect Windows systems. Users of affected Linux devices should update their kernels; Windows users need take no action.
WSL 2 Kernel Vulnerability Allows BPF Programs to Modify File Cache — Here’s How to Update
A new Linux kernel vulnerability, CVE-2026-63830, allows BPF programs to write to file-backed page-cache data due to a missing ownership tag in scatterlist transforms. WSL 2 on Windows runs a vulnerable Linux kernel and needs an immediate update via `wsl --update`. The patch is available in stable kernel series; all Linux systems should be updated to prevent integrity failures.
MediaTek Wi-Fi Kernel Bug Patched: Why Windows PCs Are Safe and Who Still Needs to Update
Linux kernel CVE-2026-63832 fixes a MediaTek MT7925 Wi-Fi driver bug causing kernel list corruption and crashes. Windows is not affected because it uses different drivers. However, users with dual-boot systems or Linux VMs with passthrough should update to kernel 6.18.38 or 7.1.3. This article explains the flaw, who really needs to act, and how to stay safe.
CVE-2026-63807: Patch Your Linux KVM Hosts to Stop Guest-Triggered Crashes
CVE-2026-63807 is a Linux KVM host vulnerability that allows a guest VM to trigger a host crash via an out-of-bounds memory access in the shadow MMU hugepage recovery path. Patches are available in upstream kernel releases 5.15.211, 6.1.177, 6.6.144, 6.12.95, and 6.18.38, but administrators must verify their distribution’s backport and reboot the host to apply the fix. No CVSS score or evidence of VM escape has been assigned, making this a high-availability concern for KVM environments.
Unpatched WSL2 Kernel Flaw Puts Developers at Risk — And Windows Update Can’t Fix It
A reported Linux kernel vulnerability in WSL2 (CVE-2026-31431) exists outside the scope of Windows Update. This article explains why the bug matters, how to check and update the WSL kernel manually, and what steps IT administrators should take to manage risk while Microsoft has yet to issue an official advisory.
CVE-2026-63858: The Linux Kernel nftables Flaw That's Hiding in Your Windows Environment
CVE-2026-63858 is a Linux kernel vulnerability in nftables that can corrupt firewall state when network device hooks are removed. While it doesn't directly impact Windows, it affects Linux instances in WSL, Hyper-V, and Azure environments that Windows admins may manage. No exploit has been demonstrated yet, but administrators should patch affected systems immediately, prioritizing those with dynamic network interfaces.
Linux Bluetooth LE Audio Data Race Patched; WSL 2 Users Urged to Check Kernel
A data-race vulnerability in Linux's Bluetooth LE Audio stack (CVE-2026-63871) has been patched upstream. The bug does not affect native Windows Bluetooth, but Windows Subsystem for Linux 2 users running custom or outdated kernels may be impacted. WSL 2 admins should update their WSL kernel and verify the fix to avoid potential stability issues with Bluetooth ISO connections.
Linux Kernel 6.18.32 Patches a Tricky Adreno GPU Freeze—And Dual-Booting Windows Users Might Be Affected
CVE-2026-53377 is a Linux kernel vulnerability in the Qualcomm Adreno GPU driver that can leave the hardware permanently frozen after a hang. Fixed in Linux 6.18.32, 7.0.9, and mainline 7.1, the patch forces an immediate GPU recovery instead of relying on power management. Windows on Snapdragon is unaffected, but dual-booters and native Linux users on Qualcomm hardware must update to avoid graphics lockups.
A 19-Year-Old Linux Kernel Bug Just Became a WSL 2 Patching Priority
CVE-2026-53400 is a 19-year-old Linux kernel bug in the I2C subsystem that affects WSL 2 and custom Linux kernels on Windows. It can cause NULL-pointer dereferences or use-after-free when adapters are registered. Windows itself is not vulnerable, but WSL 2 users must manually check and update their kernel beyond standard Windows patches. The fix is in Linux stable branches 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
CVE-2026-53401: Why Your Embedded Linux Device Needs a Kernel Update, Not Your PC
CVE-2026-53401 exposes a race condition in the Linux kernel's OMAP2 framebuffer driver that can lead to memory corruption on legacy TI hardware. While Windows desktops are unaffected, administrators managing embedded Linux devices must verify their kernel versions and apply updates to prevent privilege escalation or system crashes.