Loading story…
CVE-2025-22097 affects the Linux kernel's DRM Virtual Kernel Mode Setting (VKMS) driver (drivers/gpu/drm/vkms/vkms_drv.c). A failed driver initialization can cause vkms_exit() to access an uninitialized or already freed default_config pointer, creating a use-after-free or possible double-free condition. The flaw was introduced in Linux kernel 5.12.
The issue is fixed in stable kernels 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, and 6.15-rc1, and organizations should deploy a current stable kernel or applicable vendor errata. Red Hat rated the vulnerability moderate severity with CVSS 6.7, versus CVE.org's 7.8; Red Hat said an unprivileged local user cannot intentionally force VKMS initialization failure in its supplied configurations and released errata for multiple RHEL versions.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:15447 to remediate CVE-2025-22097 in the Red Hat Enterprise Linux 10 kernel.
Red Hat released RHSA-2025:13960 and RHSA-2025:13961 to fix CVE-2025-22097 in Red Hat Enterprise Linux 8 kernel and kernel-rt packages.
Red Hat released RHSA-2025:20518 as an additional RHEL 9 kernel remediation for CVE-2025-22097.
Red Hat issued RHSA-2025:18043 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Solutions update-stream kernels.
RHSA-2025:17009 remediated the vulnerability in RHEL 8.8 Telecommunications Update Service and Update Services for SAP Solutions kernel packages.
Red Hat issued RHSA-2025:15661 to fix CVE-2025-22097 in Red Hat Enterprise Linux 9 kernel packages.
The issue was fixed in stable kernel releases 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, and 6.15-rc1. The remediation defers initialization of default_config until VKMS driver initialization succeeds.
The Linux kernel CVE team assigned CVE-2025-22097 to the VKMS initialization-error vulnerability in drivers/gpu/drm/vkms/vkms_drv.c.
The use-after-free and potential double-free flaw in the DRM Virtual Kernel Mode Setting driver was introduced in Linux kernel 5.12. On failed initialization, vkms_exit() could access an uninitialized or already freed default_config pointer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2023-52648** is a moderate-severity flaw in the Linux kernel's VMware graphics driver, `drm/vmwgfx`, that can let a local user trigger a denial of service through a kernel null-pointer dereference. When a plane state changes, the driver can unreference a cached surface without clearing its mapped-state flag, leaving duplicated plane-state data inconsistent; cleanup can then crash the kernel. The issue was observed with KDE KWin 6.0 on Wayland and affects code introduced in Linux kernel 5.19. The defect is fixed in upstream Linux kernel versions 6.6.24, 6.7.12, 6.8.3, and 6.9-rc1. Red Hat assigned CVSS 3.1 score **5.5** and released corrected kernel packages for Red Hat Enterprise Linux 8 and 9, including RHEL 9.4 Extended Update Support; the RHEL 9 `kernel-rt` package remained affected, while RHEL 6 and 7 were outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2023-51043** is a use-after-free flaw in the Linux kernel DRM atomic modesetting subsystem. A local low-privileged attacker can race a nonblocking atomic display commit against unloading or removing a graphics driver, allowing the asynchronous commit to outlive the `drm_device` reference inherited from its ioctl context. Successful exploitation can cause denial of service or potentially local privilege escalation; Red Hat assigns a CVSS v3.1 score of 7.0. The issue affects kernels before version 6.4.5 and was fixed upstream in commit `4e076c73e4f6e90816b30fcd4a0d7ab365087255`, which makes each `drm_atomic_state` retain a `drm_device` reference until the atomic state is freed. Red Hat identified affected RHEL 8 and 9, including selected Extended Update Support, real-time kernel, and Red Hat Virtualization releases, and issued kernel updates. Organizations should deploy the applicable kernel updates; where patching is not immediately possible, Red Hat recommends preventing the DRM kernel module from loading.
Aug 26, 2026