Loading story…
CVE-2024-56675 is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its perf_event; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3.
Red Hat rated the issue Moderate (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring CAP_SYS_ADMIN or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:20095 for RHEL 10 and RHSA-2025:20518 for RHEL 9 to address CVE-2024-56675. RHEL 9 kernel-rt remained listed as affected.
Linux kernel fixes were made available in versions 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. The remediation explicitly waits for a tasks-trace-RCU grace period after removing a BPF program attachment from a perf event.
The Linux kernel CVE team assigned CVE-2024-56675 to the BPF tracing use-after-free issue in kernel/trace/bpf_trace.c. The flaw can allow a BPF program freed after a normal RCU grace period to remain accessible on an uprobe path protected by tasks-trace-RCU.
A change in Linux kernel 6.0 introduced mismatched normal-RCU and tasks-trace-RCU lifetime handling for BPF programs attached to uprobes, creating a potential use-after-free condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity kernel updates for Red Hat Enterprise Linux 9 and RHEL 9.4 Extended Update Support that remediate **CVE-2024-47675**, a use-after-free flaw in `bpf_uprobe_multi_link_attach()`. If `bpf_link_prime()` fails, an error path can free an array of `bpf_uprobe` objects without unregistering them, leaving a freed consumer on the uprobe consumer list and leaking the associated uprobe object. The fix is included in RHSA-2024:10942 for the RHEL 9.4 kernel `5.14.0-427.48.1.el9_4` and RHSA-2024:11486 for RHEL 9. These advisories also address additional kernel flaws affecting components including BPF, Bluetooth, NFS, XFRM, KVM, ARM64 probes, GICv4, and NUMA scheduling across x86_64, ARM64, IBM z, and Power architectures. Organizations should apply the applicable updated kernel packages and reboot systems for remediation to take effect.
Aug 26, 2026
**CVE-2024-58088** is a Linux kernel BPF flaw that lets a sufficiently privileged local attacker cause a system deadlock while cgroup local storage is being freed. Introduced in kernel 6.2, the affected `BPF_MAP_TYPE_CGRP_STORAGE` cleanup path passed a null busy counter to `bpf_local_storage_map_free()`, enabling a BPF program invoked during cleanup to recursively access storage and attempt to reacquire an already held local-storage lock. Repeated creation and destruction of crafted BPF programs can leave a worker thread deadlocked, causing an availability impact. The issue is fixed upstream in Linux 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4 and later; administrators should deploy a current stable kernel rather than cherry-pick the patch. Red Hat rates the issue Moderate (CVSS 4.4) and has issued fixes for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 9 `kernel-rt` is affected, while RHEL 6, 7, 8 and their listed real-time kernel variants lack the vulnerable code.
Aug 26, 2026
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026