Loading story…
CVE-2025-21727 is a use-after-free flaw in the Linux kernel's padata parallel-data processing subsystem, affecting padata_reorder() in kernel/padata.c. When a cryptographic algorithm is removed while reorder processing is still running, one thread can free a reference-counted parallel-data object while another accesses it through padata_find_next(), causing a kernel crash, denial of service, or potential privilege escalation. The vulnerability was introduced in Linux kernel 5.4 and is reproducible with the LTP pcrypt_aead01 test.
The upstream fix adds synchronize_rcu() to padata_free_shell() so serial-processing operations finish before the affected object is released. Patched upstream releases include Linux 6.1.129, 6.6.76, 6.12.13, 6.13.2, and 6.14-rc1; Red Hat has also released fixes across multiple Red Hat Enterprise Linux kernel packages and update streams. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.0, while the CVE record assigns a 7.8 score.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:12662, providing a fix for CVE-2025-21727 in the Red Hat Enterprise Linux 10 kernel.
Red Hat published CVE-2025-21727 for an improperly synchronized use-after-free in the Linux kernel padata subsystem. Exploitation may cause instability or denial of service and could enable privilege escalation.
Red Hat issued RHSA-2025:20095, an additional RHEL 10 kernel advisory containing a fix for CVE-2025-21727.
Red Hat listed RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On as fixed through RHSA-2025:15035.
RHSA-2025:13776 addressed CVE-2025-21727 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat released RHSA-2025:13589 for the RHEL 8 kernel and RHSA-2025:13590 for the RHEL 8 kernel-rt package, addressing CVE-2025-21727.
The remediation added synchronize_rcu() to padata_free_shell so serial padata processing completes before associated data is freed. The fix was included in Linux 6.1.129, 6.6.76, 6.12.13, 6.13.2, and 6.14-rc1.
A change in Linux kernel version 5.4 introduced a use-after-free condition in padata_reorder(), allowing padata_find_next() to access a freed parallel-data object during algorithm deletion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026
**CVE-2024-26826** is a moderate-severity Linux kernel flaw in Multipath TCP (MPTCP) that can cause unacknowledged data to be lost when a subflow becomes stale. An invalid optimization invoked a TCP-specific retransmission-queue helper on an MPTCP socket; following a TCP fast-path variable reorganization, the check could skip required data reinjection, creating a denial-of-service condition through lost retransmitted packets. The defect was introduced in kernel version 5.15. The issue is fixed in stable kernels `5.15.149`, `6.1.79`, `6.6.18`, `6.7.6`, and `6.8` and later. Red Hat rated the vulnerability CVSS 3.1 **5.5** (moderate), citing local low-complexity exploitation with low privileges and high availability impact, and released updated kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems; RHEL 6 is not affected. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2024-58088** is a Linux kernel BPF flaw that lets a sufficiently privileged local attacker cause a system deadlock while cgroup local storage is being freed. Introduced in kernel 6.2, the affected `BPF_MAP_TYPE_CGRP_STORAGE` cleanup path passed a null busy counter to `bpf_local_storage_map_free()`, enabling a BPF program invoked during cleanup to recursively access storage and attempt to reacquire an already held local-storage lock. Repeated creation and destruction of crafted BPF programs can leave a worker thread deadlocked, causing an availability impact. The issue is fixed upstream in Linux 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4 and later; administrators should deploy a current stable kernel rather than cherry-pick the patch. Red Hat rates the issue Moderate (CVSS 4.4) and has issued fixes for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 9 `kernel-rt` is affected, while RHEL 6, 7, 8 and their listed real-time kernel variants lack the vulnerable code.
Aug 26, 2026