Loading story…
A flaw tracked as CVE-2025-37861 affects the Linux kernel's scsi: mpi3mr driver, where improper synchronization between the reset thread and the task management thread can expose an invalid reply queue ID of 0xFFFF during controller reset. That race can cause the task management path to reference unallocated memory and trigger a kernel crash, making the issue a denial-of-service risk. Red Hat rated the bug Moderate with a CVSS 6.3, while NVD and CVE.org scored it 7.8; Red Hat said exploitation requires local access with a special group privilege and noted no integrity impact in the known use case.
Upstream Linux fixed the bug by adding an io_admin_reset_sync flag to coordinate reset, I/O, and admin thread access to reply queues, block processing during reset, and mark the controller unrecoverable if synchronization does not complete within 10 seconds. The Linux kernel CVE team said the issue is resolved in versions 6.12.24, 6.13.12, 6.14.3, and 6.15-rc1, and advised users to move to the latest stable kernel release. Red Hat also shipped fixes across multiple Red Hat Enterprise Linux 9 variants, including kernel-rt updates in advisory RHSA-2026:3358, while stating RHEL 10 is affected and RHEL 6 and RHEL 7 kernel packages are not affected because the vulnerable code is absent.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat lists CVE-2025-37861 as fixed in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions kernel-rt via RHSA-2026:14137. The Red Hat CVE record states this advisory was released on 2026-05-06.
Red Hat lists CVE-2025-37861 as fixed in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions kernel via RHSA-2026:13936. The Red Hat CVE record states this advisory was released on 2026-05-06.
Red Hat lists CVE-2025-37861 as fixed in Red Hat Enterprise Linux 9.4 Extended Update Support through RHSA-2026:3692. The Red Hat CVE record states this advisory was released on 2026-03-04.
Red Hat lists CVE-2025-37861 as fixed in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel via RHSA-2026:3267. The Red Hat CVE record states this advisory was released on 2026-02-25.
On 2026-02-25, Red Hat issued RHSA-2026:3358, a Moderate security advisory for the kernel-rt package in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle offerings. The advisory includes a fix for CVE-2025-37861 among multiple Linux kernel vulnerabilities.
Red Hat lists CVE-2025-37861 as fixed in Red Hat Enterprise Linux 9.6 Extended Update Support through advisory RHSA-2026:3088. The Red Hat CVE record states this advisory was released on 2026-02-23.
On 2025-05-09, the Linux kernel CVE team published an advisory for CVE-2025-37861 describing a race condition in the SCSI mpi3mr driver that can lead to access of unallocated memory and a crash. The advisory states the issue was fixed in kernel versions 6.12.24, 6.13.12, 6.14.3, and 6.15-rc1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026
**CVE-2022-3623** is a moderate-severity Linux kernel flaw in `follow_page_pte` within `mm/gup.c`. A race condition can poison a page-table entry, enabling a local, low-privileged attacker to trigger denial of service. The defect is classified as **CWE-123** (write-what-where condition), a memory-corruption weakness that can permit arbitrary memory modification and, in some cases, code execution or privilege escalation. The issue was fixed upstream in Linux 6.1-rc1. Red Hat released corrected `kernel` and `kernel-rt` packages for affected RHEL 8 and RHEL 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and RHEL 7 kernel variants were not affected. Red Hat assigned CVSS 3.1 score **5.8** and stated that no qualifying mitigation was available, making deployment of vendor updates the recommended remediation.
Aug 26, 2026