Loading story…
CVE-2022-3707 is a double-free flaw in the Linux kernel's Intel GVT-g graphics virtualization driver. Under high DMA load, failure of intel_gvt_dma_map_guest_page() can cause ppgtt_invalidate_spt() to free an SPT object before error handling in split_2MB_gtt_entry frees it again, enabling a local user to trigger a system crash or resource-exhaustion condition. Red Hat rates the issue Moderate, with a CVSS score of 5.1 and primary impact to availability.
Upstream maintainers corrected the memory-management path by separating SPT invalidation from deallocation, adding ppgtt_invalidate_and_free_spt() so objects are freed only after successful invalidation. The fix was included in Fedora kernel 6.1.5 and backported to Linux 6.0.19; Red Hat shipped updates for affected RHEL 8, RHEL 9, RHEL 8.6 EUS, and Red Hat Virtualization 4 deployments. RHEL 6 and RHEL 7 variants are not affected.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2736 for the RHEL 8 kernel-rt package and RHSA-2023:2951 for the RHEL 8 kernel package, addressing CVE-2022-3707.
Red Hat shipped fixes for CVE-2022-3707 for Red Hat Enterprise Linux 9 through RHSA-2023:2148 for kernel-rt and RHSA-2023:2458 for the kernel package.
Fedora fixed the Intel GVT-g double-free issue through its Linux 6.1.5 stable-kernel rebase. The fix was also backported to Linux kernel 6.0.19.
RHSA-2024:0724 delivered fixes for the RHEL 8.6 Extended Update Support kernel package and the Red Hat Virtualization 4 for RHEL 8 kernel package.
Red Hat closed Bugzilla bug 2137979, its tracking record for the Linux Intel GVT-g double-free vulnerability, while further product updates remained tracked on the CVE page.
Zheng Wang submitted version 3 of a patch for the DRM i915 GVT code to prevent an SPT object from being freed twice after intel_gvt_dma_map_guest_page() fails. The patch separated SPT invalidation from deallocation in drivers/gpu/drm/i915/gvt/gtt.c.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026