A Zero-Day Vulnerability Hidden for Over 19 Years Found in the Linux Kernel

A security researcher has reported the discovery of a zero-day vulnerability in the Linux kernel that, according to available information, remained hidden for more than 19 years. The find was submitted through Google's kernelCTF program, which focuses on finding and fixing critical vulnerabilities in the Linux kernel.

The vulnerability has been assigned the official identifier CVE-2026-43456. According to the published report, the researcher received a reward of $80,000 for discovering and disclosing the issue.

The kernelCTF program, launched by Google, offers cash rewards for exploitable vulnerabilities found in the Linux kernel running in controlled test environments. Initiatives like this are meant to encourage the security research community to systematically hunt for problems in a critical piece of infrastructure that underpins most server and cloud systems.

The very fact that the vulnerability went unnoticed for nearly two decades underscores how difficult it is to audit the Linux kernel's code, which runs to millions of lines and is developed by thousands of contributors around the world. The long lifespan of such defects before they are discovered often sparks debate about the need for a more systematic approach to security auditing of open-source code — especially those parts of it that have been used unchanged for many years.

Details about the nature of the vulnerability, the affected kernel versions, and the status of the fix are not disclosed in the public material. Additional technical information is available in the researcher's original report.

Source: Lobsters