Linux page cache exploits and Patch Tuesday risk: are your controls keeping up?

TL;DR: June’s Patch Tuesday includes 204 CVEs and three publicly disclosed zero-days, while the Linux page cache flaws Copy Fail, Dirty Frag, and Fragnesia are being exploited to reach root on broadly affected systems, according to Expel. The operational lesson is that patching speed and privilege containment now determine whether a local bug becomes full-system compromise.

NHIMG editorial — based on content published by Expel: June 2026 Patch Tuesday and Linux page cache exploitation analysis

By the numbers:

• June’s Patch Tuesday release includes 204 CVEs, including three publicly disclosed zero-day vulnerabilities.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.

Questions worth separating out

Q: What breaks when a Linux local exploit can alter the page cache instead of the file on disk?

A: The usual assumption that file integrity tools and on-disk monitoring will catch the change breaks down.

Q: Why does PQC planning matter to IAM and PAM teams?

A: Because authentication, privileged access, and workload trust all depend on cryptographic primitives that may need post-quantum replacement.

Q: How do teams know whether Linux patch prioritisation is working?

A: The strongest signal is whether exploited or KEV-listed flaws move through an emergency patch lane faster than routine updates.

Practitioner guidance

• Accelerate patching for KEV-listed Linux privilege flaws Create an emergency lane for Linux kernel updates when a flaw is publicly exploited and enables root-level escalation, then verify rollout on hosts that run identity tooling, secrets brokers, or admin interfaces.
• Inventory Linux hosts that can broker identity compromise Map every Linux system that stores API keys, service account tokens, authentication modules, or active sessions so privilege-escalation exposure can be tied to identity impact.
• Reduce persistent root access on exposed workloads Replace standing administrative access with tightly scoped elevation and isolate service credentials from general-purpose hosts so a local exploit cannot immediately reach privileged identity material.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The full CVE-by-CVE prioritisation list for June’s Patch Tuesday release, including how the team ranked the most urgent Windows issues.
• Detailed incident context on how Copy Fail and Dirty Frag were observed in active exploitation against Linux EC2 and GLPI environments.
• Specific guidance on the Linux distributions and host classes most likely to need immediate remediation.
• The SOC observations behind the root-level compromise path and how the attackers modified the in-memory /usr/bin/su binary.

👉 Read Expel's analysis of June Patch Tuesday and Linux page cache exploitation →

Linux page cache exploits and Patch Tuesday risk: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →