Telegram RegisterThe public register of Telegram
Telegram profile photo for Linux Kernel Security

Channel

Linux Kernel Security

@linkersec

On this record: Topic · Growth · Engagement · Reactions · Posts · Citations · Cite this entry

4,702subscribers

+94 since we began measuring on 6 August 2026

Risers and fallers across the register · movement among entries of 3,162–10,000.

Register entry

Telegram ID-1001320910805
TypeChannel
Username@linkersec
Created4 November 2020 — measured — cross-checked against a third-party dataset (ext.tg_channel)
First recorded6 August 2026
Last confirmed live18 September 2026
Measurements held14
Confirmed unchanged1 time, most recently 18 September 2026
On Telegramt.me/linkersec

Topic

Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 13 September 2026 and assigned it the closest of 31 fixed categories, at 98% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and why it has no browse page of its own yet.

Growth

4,6084,7024,6556 August 2026 — 4,608 subscribers6 August 2026 — 4,608 subscribers9 August 2026 — 4,615 subscribers13 August 2026 — 4,629 subscribers16 August 2026 — 4,637 subscribers19 August 2026 — 4,640 subscribers23 August 2026 — 4,650 subscribers26 August 2026 — 4,659 subscribers29 August 2026 — 4,668 subscribers1 September 2026 — 4,683 subscribers6 September 2026 — 4,693 subscribers11 September 2026 — 4,684 subscribers14 September 2026 — 4,695 subscribers18 September 2026 — 4,702 subscribers6 August 202618 September 2026
14 measurements spanning 44 days, net +94. Dots are measurements; the straight line between them is drawn to join them, not to claim we know the path taken in between — snapshots are recorded only when a count changes, so gaps mean “no change observed”, never “interpolated”. The vertical axis spans 4,594–4,716 and does not start at zero.
Measurement log — every subscribers count we have recorded
Measured (UTC)SubscribersChange
18 Sept 2026, 22:364,702+7
14 Sept 2026, 12:184,695+11
11 Sept 2026, 08:554,684-9
6 Sept 2026, 18:174,693+10
1 Sept 2026, 20:154,683+15
29 Aug 2026, 09:274,668+9
26 Aug 2026, 15:354,659+9
23 Aug 2026, 11:034,650+10
19 Aug 2026, 18:424,640+3
16 Aug 2026, 18:244,637+8
13 Aug 2026, 00:194,629+14
9 Aug 2026, 18:424,615+7
6 Aug 2026, 08:454,608no change
6 Aug 2026, 08:384,608first reading

Engagement

20 posts held, back to 20 April 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 7 pages of Telegram’s post history, 20 posts per page.

Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 20 posts for this entry, the most recent from 11 August 2026. An engagement rate over an empty window would be a number about nothing.

Reaction mix

244 reactions across 19 posts, in 6 distinct kinds. The most used accounts for 70.9% of them.

Every reaction kind recorded on the sample, most used first
ReactionCountShareShare, drawn
🔥17370.9%
👍4016.4%
👏166.56%
🤔83.28%
🤯52.05%
🎉20.82%

No sentiment is inferred, and none should be read in. This table is ordered by count and by nothing else. Emoji do not carry stable meaning across languages or communities — 🙏 is thanks in one channel and mourning in another — so we publish which ones were pressed and how often, and pass no judgement on what an audience meant by them.

Precision. Telegram publishes reaction counts per emoji and short-forms each one — 4.34K, 1.2M — so any single kind at or above 1,000 reaches us at three significant figures, and only counts below 1,000 are exact. The shares above are ratios of those figures and carry the same error. This is also why the total here can differ slightly from a reaction total printed elsewhere on the page: both are sums of the same rounded parts, taken over samples with different edges.

Coverage. Reactions were read on 19 of the 20 sampled posts in this sample. Summed by Telegram’s own count on each post — not by adding up the per-emoji breakdown above — those same posts carry 244 reactions in total: the kind of figure the paragraph above means by “a reaction total printed elsewhere on the page”.

Measured over the 20 most recent posts we hold, published 20 April 2026 to 11 August 2026, using the newest reading held for each. Telegram Stars are excluded: they are a payment, not a reaction, and they have their own section.

Recent posts

11 Aug 2026, 10:12 UTC667 views7 reactionsread 12 August 2026
Photo

IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (racy stack use-after-free in the futex implementation) to Android. The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE.

🔥7

Signed Alexander Popov

23 Jul 2026, 21:59 UTC≈1,990 views12 reactionsread 12 August 2026
Photo

I handed the epoll UAF to an agent Article by Guy Beck about using Claude for porting an exploit for an eventpoll vulnerability to Android.

🔥8👍3🤔1

Signed Andrey Konovalov

21 Jul 2026, 23:12 UTC≈1,990 views17 reactionsread 12 August 2026
Photo

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years Article about exploiting a racy stack use-after-free in the futex implementation. The bug was used to pwn a kernelCTF instance.

🔥15👍2

Signed Andrey Konovalov

20 Jul 2026, 22:44 UTC≈2,010 views9 reactionsread 12 August 2026
Photo

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) Article by Stan Shaw about exploiting a page OOB write bug in the FUSE subsystem by overwriting /etc/passwd in the page cache.

🔥5🤔3👍1

Signed Andrey Konovalov

18 Jul 2026, 06:15 UTC≈2,280 views19 reactionsread 12 August 2026
Photo

Januscape: Guest-to-Host Escape in KVM/x86 Hyunwoo Kim published an article about a use-after-free vulnerability in the shadow MMU emulation of KVM/x86 (CVE-2026-53359). Both Intel (VMX) and AMD (SVM) code is affected. The article only covers achieving a kernel crash via this bug, but the vulnerability can also be exploited to escape the guest VM. The author used this bug to pwn a kvmCTF instance.

🔥13👍6

Signed Alexander Popov

8 Jul 2026, 12:39 UTC≈7,540 views19 reactionsread 12 August 2026
Photo

ITScape: Guest-to-Host Escape in KVM/arm64 Article by Hyunwoo Kim about exploiting a race condition bug in the KVM driver on the arm64 architecture to escape the guest VM.

🔥17🤔2

Signed Andrey Konovalov

3 Jul 2026, 14:50 UTC≈4,460 views25 reactionsread 12 August 2026
Photo

Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels.

🔥25

Signed Andrey Konovalov

27 Jun 2026, 14:55 UTC≈3,250 views10 reactionsread 12 August 2026
Photo

Unprivileged root via a use-after-free in DRM GEM change_handle (CVE-2026-46215) Stan Shaw published an article about exploiting UAF in a DRM GEM ioctl. The researcher reallocated freed memory as a pipe_buffer array to set PIPE_BUF_FLAG_CAN_MERGE and perform the Dirty Pipe attack.

🔥9👍1

Signed Alexander Popov

25 Jun 2026, 12:48 UTC≈2,940 views9 reactionsread 12 August 2026

Off By !: Exploiting a Use-after-Free in the Linux Kernel Oliver Sieber published a write-up about CVE-2026-23111 in nftables, which they found in early 2025 and other researchers patched upstream in February 2026. The article describes exploiting this UAF on Debian and Ubuntu.

👍5🔥4

Signed Alexander Popov

22 Jun 2026, 11:37 UTC≈2,830 views11 reactionsread 12 August 2026

CIFSwitch: a non-universal Linux local root vulnerability Asim Viladi Oglu Manizada posted an article about a nice logic bug in the interaction between the kernel CIFS subsystem and the userspace cifs-utils package. An attacker can forge a "cifs.spnego" key in Linux keyring to make the kernel run a root userspace helper to escalate privileges of the attacker's process.

🔥9👍1🤔1

Signed Alexander Popov

10 Jun 2026, 18:43 UTC≈3,210 views7 reactionsread 12 August 2026
Photo

Unix GC Remastered Article by Moe Acherir about the internals of the new Unix sockets garbage collector implementation and the analysis of CVE-2025-40214, which was used in a kernelCTF entry.

👏7

Signed Andrey Konovalov

9 Jun 2026, 17:55 UTC≈2,840 views3 reactionsread 12 August 2026

PinTheft Linux LPE Aaron Esau published an LPE exploit for a page double-free bug in the RDS zerocopy implementation, which can be turned into a page-cache overwrite through io_uring.

👏2🤔1

Signed Alexander Popov

Showing the 12 most recent of 20 posts we hold for @linkersec. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.

Forward network

Republished by

Channels on the register that have forwarded this channel's posts into their own feed.

Built only from forwarded posts we have actually read, on both sides. Coverage is early and deliberately incomplete: a missing link means we have not read the post that would prove it, never that the relationship does not exist. Counts are distinct forwarded posts observed, so they only ever go up as we read more.

Cite this entry

A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 18 September 2026 — this entry's latest reading, not the date you are reading this.

“Linux Kernel Security” (@linkersec), 4,702 subscribers as measured 18 September 2026. Telegram Register, tgregister.com/channel/linkersec.

Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.