Loading story…
CVE-2025-38079 is a double-free, slab use-after-free vulnerability in the Linux kernel's AF_ALG hash-socket implementation (crypto/algif_hash.c). It can occur when accept(2) is invoked on an algif_hash socket with MSG_MORE set and crypto_ahash_import fails: the sk2 socket object may be freed and then released again through af_alg_release. The flaw has existed since Linux 2.6.38.
Linux stable releases 5.4.294, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14.9, and 6.15 include fixes. Red Hat also released RHSA-2025:14987 for RHEL 7 Extended Lifecycle Support, providing kernel version 3.10.0-1160.138.1.el7 for x86_64, s390x, ppc64, and ppc64le. Organizations should install the applicable kernel update and reboot affected hosts; upstream recommends updating to the latest stable kernel rather than cherry-picking the patch.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2025:14987 for Red Hat Enterprise Linux 7 Extended Lifecycle Support, fixing CVE-2025-38079 with kernel package 3.10.0-1160.138.1.el7. Affected systems must be rebooted after installation for the fix to take effect.
The issue was fixed in stable kernel releases 5.4.294, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, 6.14.9, and 6.15. The kernel CVE team recommended updating to a current stable release rather than applying an individual commit.
The Linux kernel CVE team assigned CVE-2025-38079 to the AF_ALG hash-socket double-free vulnerability affecting the hash_accept path when crypto_ahash_import fails.
A flaw was introduced in Linux kernel 2.6.38 in crypto/algif_hash.c. Under an error condition in hash_accept, an algif_hash socket object can be freed twice, resulting in a slab use-after-free.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52679** is a double-free flaw in the Linux kernel Open Firmware (OF) routine `of_parse_phandle_with_args_map()` in `drivers/of/base.c`. Present since kernel 4.17, the bug can occur when an inner loop releases an OF-node reference while retaining a stale pointer value, potentially freeing the same object twice. Exploitation requires local access and low privileges, with no user interaction; NVD and CVE.org score it 7.8 CVSS v3.1, while Red Hat rates it Low at 5.5. The flaw is fixed in stable kernels 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, and 6.8 and later. Red Hat has released fixes for RHEL 8 standard and real-time kernels and for RHEL 9 standard kernels, including RHEL 9.4 Extended Update Support; RHEL 9 `kernel-rt` remains affected. RHEL 6 is unaffected, while unsupported RHEL 7 kernel and `kernel-rt` deployments should be treated as affected; administrators should upgrade to a current vendor-supported kernel release rather than cherry-pick the patch.
Aug 26, 2026
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026
A flaw in the Linux kernel `crypto` `asymmetric_keys` subsystem, tracked as **CVE-2025-68724**, was fixed after maintainers found that `asymmetric_key_generate_id` could overflow while calculating the size of key identifier data derived from X.509 certificate fields. The bug affects kernels dating back to **3.18** and could trigger a buffer overflow when processing maliciously large certificate values, including ASN.1 INTEGER serial numbers and issuer names. Upstream kernel maintainers addressed the issue by adding `check_add_overflow()` validation and returning `ERR_PTR(-EOVERFLOW)` when oversized input is detected, with fixes released across multiple stable branches including **6.12.63**, **6.17.13**, **6.18.2**, and **6.19-rc1**. Red Hat published the vulnerability as a **Moderate** issue with a **CVSS 7.1** rating and shipped remediations through multiple RHEL 8, 9, and 10 kernel errata. One of the affected advisories, **RHSA-2026:23237**, delivered updated kernel packages for several **RHEL 9.4** SAP-related variants and included CVE-2025-68724 among a broader set of 12 kernel fixes; Red Hat said systems must be rebooted after installation for the updates to take effect. The vendor tied the flaw to **CWE-190** integer overflow and advised customers to apply the updated kernel packages rather than rely on partial fixes.
Aug 25, 2026