Loading story…
A use-after-free race condition in the Linux kernel's APM X-Gene hardware-monitoring driver, tracked as CVE-2023-1855, affects the xgene_hwmon_remove function. A local, privileged attacker on systems using the affected CPU family could trigger a system crash and potentially disclose kernel information. The upstream fix was included in Linux 6.3-rc3 as part of the hardware-monitoring driver fixes.
Red Hat rated the flaw Low severity (CVSS 3.1: 6.4) because exploitation requires elevated local privileges and affected X-Gene hardware. Fixes were released for multiple Red Hat Enterprise Linux 8 and 9 kernel packages, including specified RHEL 8 Extended Update Support versions; RHEL 9 kernel-rt remained listed as affected. Organizations unable to patch can mitigate exposure by preventing the apm_xgene kernel module from loading.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:6901 for the RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, addressing CVE-2023-1855.
Red Hat addressed CVE-2023-1855 in the Red Hat Enterprise Linux 9 kernel through advisory RHSA-2023:6583.
Rohit Keshri reported the xgene-hwmon use-after-free vulnerability, which could let a local privileged attacker crash a system and potentially disclose kernel information.
Red Hat issued RHSA-2024:0575 to address CVE-2023-1855 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
RHSA-2024:0412 fixed CVE-2023-1855 in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8 kernel.
Guenter Roeck sent Linus Torvalds a pull request for Linux v6.3-rc3 hwmon fixes that included Zheng Wang's fix for a use-after-free race in xgene_hwmon_remove.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
Red Hat remediated **CVE-2022-42703**, a moderate-severity Linux kernel memory-management flaw in `mm/rmap.c` involving incorrect double reuse of a leaf `anon_vma` in `is_mergeable_anon_vma()`. An unprivileged local attacker could repeatedly invoke fork and memory operations to trigger a use-after-free and memory leak, causing a system crash. The issue affects kernels before version 5.19.7; upstream fixed it in commit `2555283eb40df89945557273121e9393ef9b542b`. Red Hat rated the flaw CVSS 3.1 **5.5**, with high availability impact and no assessed confidentiality or integrity impact. Fixes were issued for RHEL 7, 8, 8.6 Extended Update Support, 9, 9.0 Extended Update Support, and Red Hat Virtualization 4 on RHEL 8; Fedora incorporated the stable 5.19.7 kernel fix. RHSA-2023:3388 delivered the fix for RHEL 8.6 EUS alongside patches for three other kernel vulnerabilities. Organizations should install the applicable updated kernel packages and reboot affected systems; Red Hat identified no separate supported mitigation.
Aug 26, 2026
**CVE-2023-33951** is a moderate-severity race condition in the Linux kernel’s `vmwgfx` driver affecting its handling of GEM objects. Improper locking can allow a local, highly privileged attacker to disclose kernel-context information, with Red Hat also assessing a low availability impact. Red Hat assigned a CVSS v3.1 score of 6.7; NVD scored it 5.3, reflecting a higher assessed attack complexity. Red Hat released fixes through errata for affected Red Hat Enterprise Linux 8 and 9 kernel package streams between November 2023 and July 2024. RHEL 9 `kernel-rt` remains listed as affected. Organizations should apply the relevant kernel updates and, where patching is not immediately possible, prevent the `vmwgfx` kernel module from loading.
Aug 26, 2026