September 2025 Linux Patch Roundup

September 2025 Linux Patch Roundup: Critical Vulnerabilities and Exploits

Summary

In September 2025, over 1,348 new vulnerabilities were identified and patched across major Linux distributions including Debian, Ubuntu, SUSE, Oracle, and Red Hat. More than 2,151 total vulnerabilities were highlighted during this period, spanning issues from information disclosure and privilege escalation to remote code execution.

HiveForce Labs has flagged 13 high-severity vulnerabilities that are either actively exploited or have a high probability of exploitation. These vulnerabilities pose significant risks, enabling adversaries to achieve initial access, local and remote code execution, privilege escalation, and denial-of-service (DoS) conditions. The most urgent of these include:

• CVE-2025-10585 – Google Chrome V8 type confusion zero-day, allowing remote code execution via malicious webpages.

• CVE-2021-0920 – Android/Linux Kernel race condition enabling local privilege escalation.

• CVE-2025-38352 – Kernel TOCTOU race condition affecting POSIX CPU timers.

• CVE-2025-48384 – Git Link following vulnerability exploited by the Lazarus Group to perform arbitrary file writes, impacting developers and CI/CD pipelines.

• CVE-2025-54574 – Heap buffer overflow in Squid enabling remote code execution.

• CVE-2025-59359/59360/59361 – Chaos Mesh OS command injection flaws enabling remote takeover of cluster management.

• CVE-2025-8067, CVE-2025-8714, CVE-2025-27466, CVE-2025-57052 – Critical vulnerabilities that could result in privilege escalation, denial-of-service, and information disclosure.

Vulnerability Details

These vulnerabilities enable multiple adversary tactics: execution, privilege escalation, initial access, and impact. Exploitation methods range from local race conditions in kernel components to remote code execution in browsers, proxies, and cluster managers.

• CVE-2025-10585: Exploited in-the-wild; leverages malicious JavaScript for drive-by compromise leading to remote code execution.

• CVE-2021-0920 & CVE-2025-38352: Allow local privilege escalation via race conditions.

• CVE-2025-48384: Exploited by Lazarus Group, allowing malicious Git submodule manipulation and arbitrary file writes.

• CVE-2025-54574: Exploitable via remote network requests to Squid proxy, potentially leading to full compromise.

• CVE-2025-59359/60/61: Affect Chaos Mesh Controller Manager, allowing attackers to execute arbitrary OS commands over the network.

• CVE-2025-8067 & CVE-2025-27466: Lead to privilege escalation and DoS in UDisks daemon and Xen hypervisor respectively.

Recommendations

• Conduct Comprehensive Exposure Assessments: Identify exposed services, developer hosts, CI/CD pipelines, and patch them promptly.

• Enforce Regular Patch Management: Automate updates for Linux kernels, Chrome browsers, Git clients, Squid proxies, and PostgreSQL servers.

• Browser Hardening: Ensure automatic updates are enabled, disable unsupported plugins, and monitor browser telemetry for exploitation attempts.

• Secure Development Environments: Validate integrity of Git repositories, CI/CD configurations, and third-party dependencies to prevent supply-chain attacks.

• Apply Least Privilege Controls: Enforce SELinux/AppArmor policies, disable unnecessary services, and restrict root logins.

• Implement Advanced Detection: Deploy EDR/SIEM solutions, monitor for malicious command execution, privilege escalation attempts, and anomalous network traffic.

MITRE ATT&CK TTPs

• Initial Access: T1189 (Drive-by Compromise), T1190 (Exploit Public-Facing Applications)

• Execution: T1059 (Command and Scripting Interpreter), T1059.007 (JavaScript), T1203 (Exploitation for Client Execution)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Persistence & Impact: T1499 (Endpoint DoS), T1210 (Exploitation of Remote Services)

• Detection Data Sources: DS0009 (Process Monitoring), DS0015 (Application Log), DS0017 (Command Execution), DS0029 (Network Traffic)

• Mitigations: M1038 (Execution Prevention), M1050 (Exploit Protection), M1051 (Update Software), M1021 (Restrict Web-Based Content), M1017 (User Training).

References

• Linux CVE Announce

• Debian Security Tracker

• Ubuntu Security Announce

• Red Hat Security Updates

• SUSE Security Announce

• Hive Pro – CVE-2025-10585 Advisory