Loading story…
CVE-2024-58088 is a Linux kernel BPF flaw that lets a sufficiently privileged local attacker cause a system deadlock while cgroup local storage is being freed. Introduced in kernel 6.2, the affected BPF_MAP_TYPE_CGRP_STORAGE cleanup path passed a null busy counter to bpf_local_storage_map_free(), enabling a BPF program invoked during cleanup to recursively access storage and attempt to reacquire an already held local-storage lock. Repeated creation and destruction of crafted BPF programs can leave a worker thread deadlocked, causing an availability impact.
The issue is fixed upstream in Linux 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4 and later; administrators should deploy a current stable kernel rather than cherry-pick the patch. Red Hat rates the issue Moderate (CVSS 4.4) and has issued fixes for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 9 kernel-rt is affected, while RHEL 6, 7, 8 and their listed real-time kernel variants lack the vulnerable code.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20095 for RHEL 10 and RHSA-2025:20518 for the standard RHEL 9 kernel, addressing CVE-2024-58088. RHEL 9 kernel-rt remained listed as affected without an identified erratum.
The remediation passes the cgroup-storage busy counter to the map-free procedure before storage and map locking. Fixes were included in Linux kernel versions 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4.
The Linux kernel CVE team assigned CVE-2024-58088 to the BPF cgroup-storage cleanup deadlock issue. The flaw can be triggered by BPF programs that recursively access cgroup storage while local-storage locking is in progress.
Linux kernel 6.2 introduced cgroup storage for non-cgroup-attached BPF programs through commit c4bcfb38a95e. Its cgroup-storage cleanup path passed a NULL busy counter to bpf_local_storage_map_free(), creating a locking window that could lead to deadlock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-41009** is an out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation. A privileged local attacker can manipulate the consumer position and the ring buffer's double-mapped circular layout to obtain overlapping record reservations, then alter an earlier record header so that `bpf_ringbuf_commit()` accesses an incorrect page, potentially crashing the kernel. The weakness is associated with CWE-121, stack-based buffer overflow, and affects the handling of outstanding BPF ring-buffer records. The upstream fix tracks the oldest pending record position and rejects reservations when the range of outstanding records would exceed the ring-buffer size. Red Hat rates the issue **Moderate** (CVSS 3.1: 4.4), requiring local high privileges and primarily enabling denial of service; NVD assigns 5.5, while CVE.org reports 7.8 with confidentiality and integrity impacts. Red Hat issued kernel updates for multiple RHEL 8 and RHEL 9 streams, including extended-support variants, and reports no qualifying mitigation beyond applying the updates.
Aug 26, 2026
**CVE-2024-56675** is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its `perf_event`; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. Red Hat rated the issue **Moderate** (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring `CAP_SYS_ADMIN` or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
Aug 26, 2026
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026