Loading story…
CVE-2025-40047 is a use-after-free vulnerability in the Linux kernel's io_uring IORING_OP_WAITID operation. A low-privileged local attacker can race cancellation handling in io_waitid_wait() because a wait-queue entry may not be pruned after a successful return, permitting repeated callbacks, list corruption, a system crash, or potential privilege escalation. The flaw was introduced in Linux kernel 6.7.
The issue is fixed in Linux kernel versions 6.12.53, 6.17.3, and 6.18-rc1; maintainers recommend upgrading to a current stable release rather than cherry-picking the patch. Red Hat rated the vulnerability 7.8 under CVSS v3.1 and released fixes for supported Red Hat Enterprise Linux 9 and 10 kernel streams, while the RHEL 9 kernel-rt stream remains affected.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:22854, providing fixed RHEL 10 kernel packages for CVE-2025-40047.
Red Hat released RHSA-2025:21933, providing fixed RHEL 9.6 Extended Update Support kernel packages for CVE-2025-40047.
Red Hat released RHSA-2025:21469, providing fixed RHEL 9 kernel packages for CVE-2025-40047.
Red Hat released RHSA-2026:1727, providing fixed RHEL 10.0 Extended Update Support kernel packages for CVE-2025-40047.
The Linux kernel CVE team assigned CVE-2025-40047 for an io_uring waitid flaw in io_uring/waitid.c, where a cancellation race can leave a wait-queue entry installed and permit competing callbacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-2959** is a Linux kernel race condition in the watch queue implementation that can allow a local, low-privileged attacker to escalate privileges or cause a denial of service. Missing synchronization in `pipe_resize_ring()` permits a process resizing a watch-queue pipe through `ioctl(IOC_WATCH_QUEUE_SET_SIZE)` to race with a `keyctl()`-triggered notification, resulting in access to a freed buffer. The flaw is categorized as **CWE-820: Missing Synchronization**, in which concurrent unsynchronized access to shared resources can produce an unexpected state and enable data disclosure, modification, or altered execution logic. Red Hat assigned CVSS 3.1 7.0 (`AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`); RHEL 6–8 are unaffected because they lack general notification queue support, while fixes were issued for affected RHEL 9 `kernel`, `kernel-rt`, and `kpatch-patch` packages.
Aug 26, 2026
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
Researchers disclosed **CVE-2021-20226**, a reference-counting bug in the Linux kernel's `io_uring` subsystem that can allow **local privilege escalation to root**. The flaw stems from `io_uring` worker threads retaining and later using a pointer to `current->files` without properly incrementing the `files_struct` reference count, creating unsafe conditions during asynchronous file-descriptor operations. Technical analysis showed the bug can lead to a **use-after-free** involving `struct file`, particularly when `fdget()` does not increment a file object's reference count because `files_struct->count` equals 1 and a worker or calling thread closes the descriptor. Researchers said the issue affects newer Linux kernels that include `io_uring`, noted possible exploitation paths involving asynchronous workers, file-descriptor table reuse, and interaction with `execve` and privileged processes, and reported that the vulnerability was fixed by a kernel commit that correctly increments the `files_struct` reference count.
Aug 1, 2026