Linux kernel LPEs and Perl module CVEs

A large batch of Linux kernel local privilege escalations led security disclosures, accompanied by two separate Perl module flaws. Public exploits for the kernel issues raise the priority of timely patching for administrators and developers.

Twenty-one Linux kernel local privilege escalations

An oss-security post detailed 21 Linux kernel local privilege escalations, including CVE-2026-43502 known as ZcopyReaper. The report notes public exploits and minimal requirements for the flaws. Kernel maintainers and system operators should treat the set as high urgency because of the low barriers to exploitation.

Net::IP::LPM malformed prefix length handling

CVE-2026-86287 covers Net::IP::LPM versions before 1.12 for Perl, which accept malformed prefix lengths that poison lookups. The defect can corrupt longest-prefix-match results used in routing and filtering logic. Operators relying on the module need to move to 1.12 or later to restore correct behavior.

Protocol::HTTP2 unreclaimed closed streams

CVE-2026-16028 affects Protocol::HTTP2 versions before 1.14 for Perl, allowing memory exhaustion when closed streams are never removed from the connection stream table by stream_state. Unreclaimed entries can grow without bound under sustained traffic. Users of the HTTP/2 implementation should upgrade to stop the leak.