Back Feeds.4Sysops

Microsoft fixes Linux Defender bug that disabled protection after reboot

Feeds.4Sysops •IT News • July 27, 2026

Microsoft has released fixes for two Microsoft Defender for Endpoint on Linux problems: one could leave the `mdatp` service disabled after a reboot, while another blocked updates on FIPS-enabled Red Hat Enterprise Linux systems. Automatic MDE Linux extension updates could have distributed the defective builds without administrator intervention. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Defender for Endpoint Update Leaves Linux Servers Vulnerable A recent update to Microsoft Defender for Endpoint on Linux has caused significant issues, disabling the antivirus protection on affected devices after reboot. Specifically, builds 101.26042.0000 through 101.26042.0009 are impacted, leaving Linux servers exposed to threats. The problem primarily affects systems running Red Hat Enterprise Linux (RHEL) 8 and 9 in FIPS mode, where installation of the update may fail entirely. Microsoft has paused the rollout of the problematic update and is working on a revised build expected to be released by late July 2026. Users are advised to avoid upgrading to the affected build until further notice. The issues could lead to a lapse in active protection, raising concerns among system administrators. Microsoft has provided guidance for remediation, directing users to specific builds that address the vulnerabilities. 3 sources 55

Extracted Entities

Platforms (3)

Linux Microsoft Defender For Endpoint Red Hat Enterprise Linux