Loading story…
A buffer overflow in the Linux kernel's ALSA firewire-motu component was assigned CVE-2025-68347 after maintainers found that hwdep_read() could copy more bytes to a user buffer than requested while processing DSP events. The flaw affects code introduced in kernel 5.16 and occurs when the supplied buffer is smaller than the 8-byte event header, resulting in an out-of-bounds write classified as CWE-787. Upstream kernel maintainers fixed the issue by clamping the copy length with min_t() in sound/firewire/motu/motu-hwdep.c.
The Linux kernel CVE team said the bug has been resolved in multiple branches, including 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1, and advised users to update to the latest stable kernel release instead of cherry-picking patches. Red Hat rated the vulnerability Moderate with a CVSS v3 score of 7.1 and said fixes for Red Hat Enterprise Linux 8 kernel and kernel-rt packages were released, while RHEL 6, 7, 7 kernel-rt, 9, 9 kernel-rt, and 10 were listed as not affected because the vulnerable code is not present.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat states that fixes for CVE-2025-68347 were released for Red Hat Enterprise Linux 8 kernel and kernel-rt packages via advisories RHSA-2026:21706 and RHSA-2026:21745.
Red Hat's CVE entry for CVE-2025-68347 was made public, describing the Linux kernel ALSA firewire-motu out-of-bounds write and listing affected and unaffected RHEL versions.
Greg Kroah-Hartman published the Linux kernel CVE announcement for CVE-2025-68347, describing the ALSA firewire-motu hwdep_read() buffer overflow and recommending updates to the latest stable kernel releases.
The Linux kernel CVE announcement says the hwdep_read() buffer overflow was fixed using min_t() and that fixes were included in kernel versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1.
The Linux kernel CVE announcement states that the bug behind CVE-2025-68347 was introduced in Linux kernel 5.16 in the ALSA firewire-motu subsystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel `crypto` `asymmetric_keys` subsystem, tracked as **CVE-2025-68724**, was fixed after maintainers found that `asymmetric_key_generate_id` could overflow while calculating the size of key identifier data derived from X.509 certificate fields. The bug affects kernels dating back to **3.18** and could trigger a buffer overflow when processing maliciously large certificate values, including ASN.1 INTEGER serial numbers and issuer names. Upstream kernel maintainers addressed the issue by adding `check_add_overflow()` validation and returning `ERR_PTR(-EOVERFLOW)` when oversized input is detected, with fixes released across multiple stable branches including **6.12.63**, **6.17.13**, **6.18.2**, and **6.19-rc1**. Red Hat published the vulnerability as a **Moderate** issue with a **CVSS 7.1** rating and shipped remediations through multiple RHEL 8, 9, and 10 kernel errata. One of the affected advisories, **RHSA-2026:23237**, delivered updated kernel packages for several **RHEL 9.4** SAP-related variants and included CVE-2025-68724 among a broader set of 12 kernel fixes; Red Hat said systems must be rebooted after installation for the updates to take effect. The vendor tied the flaw to **CWE-190** integer overflow and advised customers to apply the updated kernel packages rather than rely on partial fixes.
Aug 25, 2026
**CVE-2024-58012** affects the Linux kernel's ASoC Sound Open Firmware (SOF) Intel HDA DAI component. Audio topologies using aggregated amplifiers can fail to create all required DAI widgets, leaving a CPU DAI linked to a NULL widget; subsequent parameter processing can trigger a NULL-pointer dereference and crash the kernel or affected audio path. The upstream fix verifies that the CPU DAI's widget exists before using it. The flaw is fixed upstream in Linux kernel versions **6.12.14**, **6.13.3**, and **6.14-rc1**; maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat shipped fixes for RHEL 10 in **RHSA-2025:20095** and RHEL 9 in **RHSA-2025:20518**; the RHEL 9 real-time kernel fix remains deferred, while RHEL 8 kernel variants are outside the affected support scope. Red Hat rates the local, high-privilege denial-of-service issue 4.4 CVSS v3.1, compared with 5.5 ratings from NVD and CVE.org.
Aug 26, 2026
A **moderate-severity** Linux kernel vulnerability, tracked as `CVE-2026-43051`, was fixed in the Wacom HID driver after maintainers found that malformed Bluetooth HID reports could trigger an out-of-bounds read in `wacom_intuos_bt_irq()`. The bug affected handling of report IDs `0x03` and `0x04`, where insufficient bounds checking allowed a malicious or compromised nearby Bluetooth device to send short reports that caused the kernel to read past the received buffer while copying data into the Wacom structure. The issue could lead to sensitive memory disclosure and system crashes. The fix adds explicit length validation for the affected report types and warning logs when undersized reports are received, with upstream patches released across multiple stable kernel branches from **5.10.253 through 7.0**. Red Hat said updates were issued for affected kernel packages in **RHEL 8, 9, and 10**, while some **RHEL 7** and **RHEL 9 `kernel-rt`** variants remained affected at publication; **RHEL 6** was not impacted because the vulnerable code was not present. Red Hat scored the flaw **CVSS 7.1**, while `cve.org` listed **8.1**.
Aug 25, 2026