Cve 2025 0432
The latest Cve 2025 0432 coverage — news, analysis, and updates from the WindowsNews.AI desk.
Linux Bluetooth Deadlock Fix Lands—Windows Hosts with Linux Guests Must Act
The Linux kernel patch for CVE-2026-64206 fixes a Bluetooth L2CAP deadlock that can hang connection teardown. While native Windows systems are unaffected, anyone running Linux under Windows—through WSL2, VMs, or managed fleets—should update those Linux kernels immediately. The fix is already available in stable releases 6.18.39, 7.1.4, and upstream 7.2-rc3.
WSL 2, Azure Linux VMs Face Crash Risk from CVE-2026-64190 Kernel Flaw — Update Now
CVE-2026-64190 is a Linux kernel vulnerability in the Team network driver that can cause a kernel crash during a mode change if traffic is transmitted simultaneously. The fix requires updating the kernel; Windows users running WSL 2, Hyper-V, or Azure Linux VMs should check for and apply vendor patches.
CVE-2026-64205: How a Linux Kernel Bug in Intel’s SMBus Driver Can Hang Your System—and How to Fix It
A newly disclosed Linux kernel flaw (CVE-2026-64205) in the Intel i801 SMBus driver causes persistent hangs and livelocks when an error path incorrectly clears hardware state. The bug affects kernels 6.3 through unfixed versions and is corrected in stable releases 6.18.39, 7.1.4, and 7.2-rc1. Linux admins should update immediately and verify that “SMBus is busy” log floods disappear post-patch.
Why a Malformed XFS Disk Can Crash Your Linux VM—and the Fix for CVE-2026-64187
A newly disclosed Linux kernel vulnerability, CVE-2026-64187, can cause a NULL pointer dereference and instant crash when mounting XFS filesystems with corrupted journals. While home Windows users face little direct risk, anyone running Linux virtual machines, WSL with XFS volumes, or managing Linux servers must update their kernels promptly to avoid denial-of-service disruptions.
Your Firewall Automation Might Be a Kernel Crash Waiting to Happen: Inside CVE-2026-64189
A newly disclosed Linux kernel vulnerability, CVE-2026-64189, allows a race condition in the ipset firewall tool to trigger kernel panics during routine management tasks. Any system running a vulnerable kernel and using IP sets—including WSL2, VMs, and container hosts—should apply the backported kernel patch immediately to prevent crashes.
Qualcomm RMNET Driver Race Condition Fixed in Linux Kernel—Check Your WSL and Cellular Devices
The Linux kernel has fixed CVE-2026-64188, a use-after-free vulnerability in the Qualcomm RMNET driver that could crash or compromise systems using cellular modems. While most Windows users are not directly affected, those running WSL2 with custom kernels or working with Qualcomm hardware should update their Linux environments immediately. The fix defers memory freeing to prevent a race condition, and all users should reboot after patching.
NGINX 1.31.3 Fixes SSI Worker Crash—Here’s Who Needs to Upgrade Now
CVE-2026-56434 is a use-after-free vulnerability in NGINX's Server-Side Includes module that can restart worker processes when SSI is enabled, proxies are used, and upstream buffering is off. Fixed in NGINX 1.31.3, 1.30.4, and Plus R36 P7. Windows administrators should inventory all NGINX instances, check for the vulnerable configuration combination, and upgrade or apply temporary mitigations like disabling SSI or re-enabling buffering.
WSL 2 Users Urged to Update Linux Kernel After BPF Panic Vulnerability Discovered
A newly disclosed Linux kernel vulnerability (CVE-2026-64192) can crash WSL 2 and other Linux environments by corrupting memory through improperly initialized BPF security hooks. The flaw affects kernels where BPF LSM is compiled in but not active at boot, and the fix rejects dangerous map creation. Windows systems are not directly affected, but WSL 2 users should update their Linux kernels immediately.
Macquarie Government's Azure Practice Targets 26% Cost Cuts for Australian Agencies
Macquarie Government has launched a co-managed Microsoft Azure practice for Australian federal and state agencies, promising an average 26% reduction in cloud costs through continuous optimization and governance. The move extends the company’s long-standing government cybersecurity business into public cloud services for the first time, offering PROTECTED-ready landing zones, managed security, virtual desktops, and hybrid Azure Local options. Agencies are advised to carefully evaluate the co-management model, validate cost savings, and plan for exit strategies before signing on.
Microsoft 365 Email Routing Alert: Why Your Inline Security Setup Needs a Second Look
Microsoft’s renewed warnings about routing Exchange Online mail through third-party security services have put a spotlight on inline email solutions like Check Point’s. While Check Point argues its architecture is safe, administrators must meticulously verify that their connectors, authentication, and security rules don’t undermine Microsoft 365’s native protections or create new vulnerabilities.
Endpoint DLP Alerts in Microsoft Purview Will Soon Feed into In-Depth Content Investigations
Microsoft will enable security analysts to launch Data Security Investigations directly from endpoint DLP alerts in Microsoft Purview starting August 2026. The integration lets teams query and collect related files across users and devices, then apply AI-assisted analysis to understand the full scope of a potential data breach. Organizations need to prepare by validating DLP coverage, enabling evidence collection, configuring tight access controls, and running pilots to avoid governance or cost pitfalls.
Microsoft Purview DLP Targets Your Google Workspace and AWS Data Starting September 2026
Microsoft Purview is expanding Data Loss Prevention and auto-labeling to Google Workspace, Box, Dropbox, Salesforce, ServiceNow, AWS, and Cisco Webex. Preview in July 2026 and general availability in September 2026 will let organizations enforce consistent policies across non-Microsoft clouds, but connector capabilities will vary. Administrators must prepare a migration from Defender for Cloud Apps file policies, which retire in January 2027.
Microsoft Purview’s File Quarantine: Sensitive Docs Will Be Plucked from SharePoint and OneDrive This July
Microsoft Purview's new File Quarantine action for SharePoint and OneDrive, rolling out globally in July 2026, physically removes sensitive files that violate DLP policies and replaces them with a tombstone message. This article explains how it works, why it's a major shift from simple blocking, and offers practical guidance for administrators to prepare and deploy the feature safely.