No sooner had we discussed the “May patches” and the prospects of AI-driven bug hunting than yet another real-world case emerged. A new critical vulnerability, CIFSwitch, has been discovered, allowing for Local Privilege Escalation (LPE) to root.

Today, operating systems powered by the Linux kernel run the world: from supercomputers and cloud giants to Internet of Things (IoT) ecosystems and critical security infrastructure. However, within engineering and academic circles, the paradigm commonly known as “Linux” carries a more precise, fundamental name - GNU/Linux.

In one of our previous publications, we analyzed the May vulnerabilities Copy Fail and Dirty Frag in detail, which allowed attackers to gain root privileges on Linux servers. However, behind the scenes of these incidents lies a much larger trend that is fundamentally reshaping the cybersecurity industry right now, in 2026.

In the world of cybersecurity, there are hundreds of vulnerabilities and potential attack vectors. However, most successful breaches occur not through complex zero-day exploits, but due to common configuration errors: default passwords, enabled legacy protocols, or excessive user permissions.

May 2026 will be remembered as one of the most turbulent periods in recent years. Critical vulnerabilities in the Linux kernel are being discovered one after another, linked by an architectural problem in the memory page cache (Page Cache).