Loading story…
Red Hat resolved CVE-2024-54456, a moderate-severity buffer-overflow flaw in the Linux kernel NFS client function nfs_sysfs_link_rpc_client(). The function appended an RPC program name of unknown length to a fixed 64-byte buffer using unsafe strcat() operations, creating a CWE-120 classic buffer-overflow condition. A local low-privileged attacker could potentially disclose information, corrupt memory, execute unauthorized code or commands, or cause a denial of service; Red Hat rates the issue CVSS 7.1, while NVD and CVE.org score it 7.8.
The upstream remediation replaces the unsafe string handling with bounded strscpy() and strncat() calls. Red Hat issued corrected kernels for RHEL 9 and RHEL 10 and later supplied a fix for RHEL 9.6 Extended Update Support; organizations should apply the applicable kernel advisories and reboot into the updated kernel. Red Hat states that the RHEL 9 kernel-rt package will not receive a fix, and RHEL 8 is outside the supported remediation scope.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20095 for Red Hat Enterprise Linux 10 and RHSA-2025:20518 for Red Hat Enterprise Linux 9, addressing CVE-2024-54456 in their kernel packages.
An upstream Linux CVE announcement reported CVE-2024-54456, a potential buffer overflow in the NFS nfs_sysfs_link_rpc_client() function caused by unsafe concatenation into a fixed 64-byte buffer. The upstream remediation replaced the unsafe operations with strscpy() and strncat().
Red Hat released RHSA-2026:2352 to address CVE-2024-54456 for Red Hat Enterprise Linux 9.6 Extended Update Support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat remediated **CVE-2022-2078**, a moderate-severity classic buffer overflow (`CWE-120`) in the Linux kernel Netfilter/nftables function `nft_set_desc_concat_parse()`. A low-privileged local attacker could trigger the flaw to cause denial of service and potentially execute code. The vulnerability was fixed upstream in commit `fecf31ee395b0295f2d7260aa29946b7605f7c85`; **CVE-2022-1972** was identified as a duplicate CVE for the same issue. Affected Red Hat products received updated kernel packages for RHEL 8, RHEL 9, and Red Hat Virtualization 4 on RHEL 8; RHEL 6 and RHEL 7 kernels were not affected. RHSA-2022:6582 delivered the RHEL 9 `kernel-rt` fix in version `5.14.0-70.26.1.rt21.98.el9_0`, alongside remediation for CVE-2022-34918. Organizations should install the applicable kernel updates and reboot systems, as no separate Red Hat-supported mitigation was available.
Aug 26, 2026
A flaw in the Linux kernel `crypto` `asymmetric_keys` subsystem, tracked as **CVE-2025-68724**, was fixed after maintainers found that `asymmetric_key_generate_id` could overflow while calculating the size of key identifier data derived from X.509 certificate fields. The bug affects kernels dating back to **3.18** and could trigger a buffer overflow when processing maliciously large certificate values, including ASN.1 INTEGER serial numbers and issuer names. Upstream kernel maintainers addressed the issue by adding `check_add_overflow()` validation and returning `ERR_PTR(-EOVERFLOW)` when oversized input is detected, with fixes released across multiple stable branches including **6.12.63**, **6.17.13**, **6.18.2**, and **6.19-rc1**. Red Hat published the vulnerability as a **Moderate** issue with a **CVSS 7.1** rating and shipped remediations through multiple RHEL 8, 9, and 10 kernel errata. One of the affected advisories, **RHSA-2026:23237**, delivered updated kernel packages for several **RHEL 9.4** SAP-related variants and included CVE-2025-68724 among a broader set of 12 kernel fixes; Red Hat said systems must be rebooted after installation for the updates to take effect. The vendor tied the flaw to **CWE-190** integer overflow and advised customers to apply the updated kernel packages rather than rely on partial fixes.
Aug 25, 2026
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 22, 2026