Loading story…
CVE-2021-47560 is a NULL-pointer dereference in the Linux kernel's Mellanox mlxsw Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port.
Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and kernel-rt packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package to address CVE-2021-47560.
Red Hat released RHSA-2023:2458 for the RHEL 9 kernel and RHSA-2023:2148 for the RHEL 9 kernel-rt package, providing fixes for CVE-2021-47560.
Red Hat released RHSA-2024:8161, fixing CVE-2021-47560 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Solutions Update Services kernel packages.
Red Hat released RHSA-2024:8107, fixing CVE-2021-47560 in the RHEL 8.8 Extended Update Support kernel package.
The Linux kernel fixes the mlxsw Spectrum CPU-port event flaw in versions 5.10.83, 5.15.6, and 5.16. The fix ignores events reported for the CPU port, preventing the NULL-pointer dereference.
A change in Linux kernel 5.4 introduced improper handling of firmware-generated CPU-port link events in the Mellanox mlxsw Spectrum driver. Because local port 0 has no associated network device, processing such events could dereference a NULL pointer and crash the system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52658** is a moderate-severity local denial-of-service flaw in the Linux kernel's Mellanox `mlx5` switchdev offload driver. A change intended to block switchdev mode when network namespace state is inconsistent can instead trigger a system crash. The vulnerable change was introduced in Linux 6.3 and backported to Linux 6.1.22 and 6.2.9; fixes revert the change and are included in Linux 6.6.22, 6.7.10, and 6.8. Red Hat rates the issue **CVSS 5.5**: exploitation requires low privileges and affects availability, with no identified confidentiality or integrity impact. Red Hat shipped fixes in RHEL 8 `kernel` and `kernel-rt` updates and the RHEL 9 `kernel` update, while RHEL 9 `kernel-rt` remained listed as affected; organizations using MLX5 adapters in switchdev mode should deploy current vendor kernel updates rather than individually cherry-picking patches.
Aug 26, 2026
**CVE-2021-47468** affects the Linux kernel's mISDN NetJet ISDN driver, where `card->isac.release()` can be invoked while a lock is held in an atomic context. Because the release path may sleep, a local attacker able to exercise the affected device-removal path could trigger a kernel fault or denial of service. The upstream fix defers the release-function call until after the lock has been released. The fix was backported to stable kernels including 4.4.290, 4.9.288, 4.14.253, 4.19.214, 5.4.156, 5.10.76, 5.14.15, and 5.15. Red Hat rated the flaw Low severity (CVSS 4.4) and released RHEL 8 kernel updates through advisories including **RHSA-2024:5101** and **RHSA-2024:5102**; RHEL 9 is not affected. Organizations should deploy their vendor's current kernel updates rather than cherry-picking the upstream patch.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026