Loading story…
Linux kernel fuzzing tools are continuing to surface hard-to-find defects in core subsystems, with coverage-guided testing and automated crash reporting helping developers trace bugs across memory management, concurrency, and system call interactions. The reporting highlights the syzkaller ecosystem—syz-manager, syz-executor, and syzbot—alongside kernel instrumentation such as KCOV, KASAN, and KCSAN, which are used to expand code coverage and detect memory-safety and race-condition issues during testing.
One cited case involved a syzbot-tracked socket memory accounting warning, identified as de6565462ab540f50e47, that was traced to a signedness flaw in TCP socket buffer remaining-space calculations. The bug corrupted internal accounting and was fixed upstream in Linux kernel commit d3a5f2871adc, titled "tcp: Correct signedness in skb remaining space calculation". The reporting also notes that syzbot crash reports do not automatically indicate exploitable vulnerabilities, because some crashes require privileged conditions or have limited security impact.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Kernel Concurrency Sanitizer (KCSAN) was documented as a compile-time instrumentation tool for detecting unauthorized data races in the Linux kernel.
Kernel Address Sanitizer (KASAN) was documented as a Linux kernel instrumentation tool for detecting out-of-bounds accesses, use-after-free bugs, and double-frees.
An upstream Linux kernel fix, commit d3a5f2871adc titled "tcp: Correct signedness in skb remaining space calculation," was merged to correct the bug. The patch replaced loose arithmetic type handling with explicit signed integer bounds after review and testing by the networking community.
Kernel developers traced the inet_sock_destruct() warning back into the TCP send path and determined the root cause was a signedness error in remaining socket buffer space calculations. Under specific packet-sizing conditions, the bug corrupted internal buffer accounting and could cause allocations to wrap negative.
syzbot identified and tracked a socket memory accounting warning under archive ID de6565462ab540f50e47, and published a minimal C reproducer for the issue. The warning manifested in inet_sock_destruct() and involved inconsistent socket memory tracking through sk_forward_alloc.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcedocs.kernel.org
Open sourcedocs.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers extended **Syzkaller** with a Syzlang grammar for crafted Ethernet frames to fuzz previously uncovered packet-reception paths in Linux’s `batman-adv` mesh-networking subsystem, particularly code in `routing.c` that had received no Syzbot coverage. The approach follows established work on exposing kernel networking interfaces to external-input fuzzing and targets protocol parsers reachable through network traffic rather than only local syscall surfaces. The campaign identified three defects: a 16-bit integer overflow in OGM fragmentation, a use-after-free race in the throughput-meter path during interface deletion, and a TT TVLV VLAN-length truncation that can produce an out-of-bounds read. The researchers’ overflow fix has been merged into Linux mainline, while patches for the use-after-free were already circulating on kernel mailing lists; organizations using `batman-adv` should track kernel updates and prioritize remediation as fixes become available.
Sep 1, 2026
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026
Google’s syzkaller project documents an external USB fuzzing framework that exercises Linux kernel USB drivers in local or virtualized environments without physical USB-emulation hardware or QEMU `usbredir`. The framework uses Raw Gadget with Dummy HCD/UDC controllers, KCOV coverage collection, and USB pseudo-syscalls to emulate enumeration, control requests, and endpoint traffic; an upstream USB-focused syzbot manager is also tracking fuzzing results. The capability targets a subsystem with a record of memory-safety flaws reachable by malicious USB devices. Earlier syzkaller research identified 15 Linux USB vulnerabilities, including NULL-pointer dereferences, use-after-free bugs, and a double-free; 13 had upstream fixes while `CVE-2019-15290` and `CVE-2019-15291` were still unpatched at the time of disclosure. Organizations should prioritize supported kernel updates and restrict untrusted USB peripherals, while noting that the current fuzzing implementation does not support USB 3 or isochronous transfers.
Aug 28, 2026