Loading story…
CVE-2025-39883 is a use-after-free flaw in the Linux kernel's memory-failure handling that can cause a kernel panic when memory is unpoisoned. An attacker with local, low-privileged access can provide an offline memory PFN through the hwpoison debugfs interface, leading unpoison_memory() to inspect the PG_HWPoison flag on an uninitialized page and trigger VM_BUG_ON_PAGE(PagePoisoned(page)). The defect has existed since Linux kernel 4.13 and affects system availability and potentially integrity.
Fixes are available in stable kernel releases 6.1.153, 6.6.107, 6.12.48, 6.16.8, and 6.17-rc6; the Linux kernel CVE team advises updating to a current stable release rather than cherry-picking patches. Red Hat rates the issue Moderate, with a CVSS 3.1 score of 7.0, and has issued fixes for multiple Red Hat Enterprise Linux 8 and 10 kernel streams; it reports no qualifying mitigation.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:22387 and RHSA-2025:22388 for RHEL 8 kernel-rt and kernel packages, respectively, and RHSA-2025:22395 for RHEL 10 kernel packages.
Red Hat released RHSA-2025:22006 with fixes for affected RHEL 8.6 kernel streams, including Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
CVE-2025-39883 was published for a use-after-free issue in mm/memory-failure.c that can trigger VM_BUG_ON_PAGE(PagePoisoned(page)) and a fatal kernel panic during memory unpoisoning. The Linux kernel CVE team identified fixed stable versions including 6.1.153, 6.6.107, 6.12.48, 6.16.8, and 6.17-rc6, and advised deploying a current stable kernel release.
CVE-2025-21786 is a resolved Linux kernel workqueue use-after-free flaw caused by prematurely releasing a pool workqueue reference while a rescuer worker is detached. Red Hat addressed the issue for RHEL 9, RHEL 9.6 Extended Update Support, and RHEL 10 through cited RHSA advisories.
Red Hat released RHSA-2026:0533 with fixed kernel packages for RHEL 8.4 Advanced Mission Critical Update Support and RHEL 8.4 Extended Update Support Long-Life Add-On.
Red Hat released RHSA-2026:0271 with fixed kernel packages for the RHEL 10.0 Extended Update Support stream.
Red Hat released RHSA-2025:23445 with fixed kernel packages for the RHEL 8.2 Advanced Update Support stream.
The vulnerable behavior was introduced in Linux kernel 4.13 by commit f1dd2cd13c4bbbc9a7c4617b3b034fa643de98fe. It allows unpoison_memory() to inspect an uninitialized page after an offline PFN is supplied through the hwpoison debugfs interface.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026
**CVE-2022-48619** is a moderate-severity denial-of-service flaw in the Linux kernel input subsystem's `input_set_capability()` function. The function failed to validate event codes against the bitmap bounds for the specified event type, allowing a low-privileged local attacker to cause a kernel panic. Red Hat assigned a CVSS v3.1 score of 5.5, reflecting high availability impact with no confidentiality or integrity impact. Upstream fixed the defect in Linux kernel 5.17.10 through commit `409353cbe9fe48f6bc196114c442b1cff05a39bc`, which adds per-event-type maximum-code validation and rejects invalid values. Red Hat remediated affected RHEL 8 kernel and `kernel-rt` packages through advisories **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 9 variants are not affected, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026
**CVE-2023-42754** is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an `sk_buff` may lack an associated network device, but `ipv4_send_dest_unreach()` assumes `skb->dev` is present and dereferences it through `dev_net(skb->dev)`, triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel. The upstream correction, commit `0113d9c9d1ccc07f5a3710dac4aa24b6d711278c`, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 `kernel-rt` remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 `kernel-rt` are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
Aug 26, 2026