Loading story…
The Linux kernel's hardware monitoring (HWMON) subsystem received a set of fixes ahead of Linux 7.2-rc7, with maintainer Guenter Roeck saying most of the changes remediate critical or high-severity bugs. Reported issues included race conditions, calculation mistakes, possible out-of-bounds memory accesses, and potential overflows affecting HWMON code paths.
The bugs were reported by Sashiko, an AI-driven bug-finding bot, highlighting how automated analysis tools are surfacing serious defects in widely used open-source software. The fixes add to a broader rise in Linux kernel patch activity tied to AI and LLM-assisted code review, as maintainers respond to newly identified reliability and security flaws.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Linux 7.2-rc7 was released on 2026-08-09 as a release candidate for the upcoming Linux 7.2 stable kernel. The release bundled numerous fixes across the kernel, including the previously noted HWMON fixes, a memory-management race-condition fix, Btrfs silent data-loss remediation, and a patch for the Safe RET Interrupt Vulnerability.
Ahead of Linux 7.2-rc7, the kernel's hardware monitoring subsystem received a batch of fixes. HWMON maintainer Guenter Roeck said most of the fixes addressed critical or high-severity bugs, including race conditions, calculation errors, possible out-of-bounds accesses, and possible overflows, with the bugs primarily reported by the Sashiko AI bot.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
phoronix.com
Open sourcephoronix.com
Open sourcesashiko.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A use-after-free race condition in the Linux kernel's APM X-Gene hardware-monitoring driver, tracked as **CVE-2023-1855**, affects the `xgene_hwmon_remove` function. A local, privileged attacker on systems using the affected CPU family could trigger a system crash and potentially disclose kernel information. The upstream fix was included in Linux `6.3-rc3` as part of the hardware-monitoring driver fixes. Red Hat rated the flaw **Low** severity (CVSS 3.1: 6.4) because exploitation requires elevated local privileges and affected X-Gene hardware. Fixes were released for multiple Red Hat Enterprise Linux 8 and 9 kernel packages, including specified RHEL 8 Extended Update Support versions; RHEL 9 `kernel-rt` remained listed as affected. Organizations unable to patch can mitigate exposure by preventing the `apm_xgene` kernel module from loading.
Aug 26, 2026
Microsoft published a broad batch of Security Update Guide entries for Linux kernel flaws affecting memory management, networking, virtualization, device drivers, and subsystem input validation. The listed issues include use-after-free, NULL dereference, integer underflow, refcount underflow, information disclosure, and bounds-checking failures tracked as **`CVE-2026-31496`**, **`CVE-2026-31458`**, **`CVE-2026-31689`**, **`CVE-2026-31615`**, **`CVE-2026-31664`**, **`CVE-2026-31656`**, **`CVE-2026-31611`**, **`CVE-2026-31671`**, **`CVE-2026-31612`**, and others. Affected components span `nf_conntrack_expect`, `damon`, `edac_mc`, `renesas_usb3`, `xfrm`, `drm/i915`, `ksmbd`, `stmmac`, `tipc`, `mptcp`, `NFC`, `HID`, `KVM`, `mmc`, `x86/CPU`, `PCI endpoint`, `blk-cgroup`, `media/as102`, and `altera-tse`. Several entries point to bugs that could lead to kernel crashes, memory corruption, or data leakage if triggered through malformed input, protocol handling, or device interaction. Notable examples include a slab use-after-free in `mptcp`, information leaks in `xfrm_user` and `xfrm`, validation flaws in `ksmbd`, endpoint index handling in `usb: gadget: renesas_usb3`, and multiple underflow and teardown-ordering bugs across networking and driver code. The disclosures indicate a coordinated publication of upstream Linux kernel fixes through Microsoft's advisory channel, underscoring the need for organizations running Linux workloads in Microsoft-connected environments to review affected kernel versions and apply vendor patches promptly.
Jul 12, 2026
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 28, 2026