Loading story…
A double-free vulnerability in the Linux kernel's NVMe subsystem, tracked as CVE-2024-41073, can let a local attacker trigger memory corruption and cause a denial of service. The bug occurs when a discard request is retried and then fails before a new special payload is attached, leaving cleanup logic to free the same resource twice unless the RQF_SPECIAL_PAYLOAD flag is cleared. The flaw affects drivers/nvme/host/core.c and is classified as CWE-1341.
The Linux kernel CVE team said the issue was fixed in stable releases 5.15.164, 6.1.101, 6.6.42, 6.9.11, and 6.10, and advised users to update to the latest stable kernel rather than cherry-picking patches. Red Hat rated the issue Moderate for its products with a CVSS v3 score of 5.5, noting fixes for multiple Red Hat Enterprise Linux 8 and 9 kernel packages through RHSA advisories, while RHEL 6 was listed as not affected; Red Hat also highlighted that external databases assigned higher scores to the same CVE.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat published its CVE entry for CVE-2024-41073, describing the Linux kernel NVMe double-free flaw as a Moderate-severity issue that a local attacker could exploit to cause memory corruption and denial of service. Red Hat also noted affected and unaffected product lines, including that RHEL 6 kernel is not affected.
The issue was fixed in Linux kernel stable releases 5.15.164, 6.1.101, 6.6.42, 6.9.11, and 6.10, with corresponding commits published for each branch. The kernel CVE announcement recommends updating to the latest stable kernel version rather than cherry-picking individual commits.
The Linux kernel CVE team assigned CVE-2024-41073 to a vulnerability in the NVMe subsystem caused by a double free during discard request retries. The flaw affects drivers/nvme/host/core.c and can occur if a retry fails before a new special payload is added.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **double-free vulnerability** tracked as `CVE-2025-71238` was disclosed in the Linux kernel's `qla2xxx` SCSI driver, affecting the block SCSI generic (`bsg`) interface used by vendor-specific handlers in `qla_bsg.c`. The flaw stems from inconsistent calls to `bsg_done()`/`bsg_job_done()` on both success and failure paths, allowing the same `bsg` job to be freed twice and potentially causing memory corruption. Kernel maintainers said the bug can trigger a kernel panic, and published crash details show faults during `qla2x00_process_vendor_specific` and `qla24xx_bsg_request` execution. Red Hat rated the issue **moderate severity** and warned that a local attacker could exploit it to cause **denial of service** by crashing the kernel, with a theoretical chance of **local privilege escalation**; the flaw is **not network reachable**. Fixes were released in upstream stable and development kernel branches as well as multiple Red Hat Enterprise Linux kernel packages. Red Hat advised customers to apply updated kernel packages, while the kernel community recommended moving to the latest stable kernel; as a mitigation, Red Hat said systems can prevent the `qla2xxx` module from loading if immediate patching is not possible.
Aug 25, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
CVE-2024-26638 is a low-severity flaw in the Linux kernel's Network Block Device (NBD) driver, introduced in kernel version 5.19. Incomplete initialization of a `struct msghdr` in the NBD reply-receive path can expose the uninitialized `msg_get_inq` field during `tcp_recvmsg` processing, triggering a KMSAN uninitialized-value error and affecting system availability. Exploitation requires local access and high privileges; Red Hat assigns a CVSS 3.1 score of 4.4. The upstream issue is fixed in Linux 6.1.76, 6.6.15, 6.7.3, 6.8, and later stable releases. Red Hat has issued fixes for affected Red Hat Enterprise Linux 8, RHEL 9, and RHEL 9.4 Extended Update Support packages, while RHEL 8 and RHEL 9 real-time kernels remain affected; unsupported RHEL 6 and 7 variants should be considered potentially affected. Organizations should update to vendor-supported current kernel releases rather than cherry-picking the individual upstream patch.
Aug 26, 2026