Loading story…
CVE-2023-1252 is a use-after-free flaw in the Linux kernel’s OverlayFS asynchronous I/O path that can be triggered when OverlayFS performs direct asynchronous reads against an underlying Ext4 filesystem. I/O completion on a separate thread can free the embedded iocb in ovl_aio_req before the lower filesystem returns from its read/write iterator, creating a system-crash and potential local privilege-escalation condition for low-privileged users.
The upstream fix adds reference counting to ovl_aio_req, retaining the I/O control block until vfs_read_iter() or vfs_write_iter() returns. The affected OverlayFS AIO implementation was introduced in Linux 5.6, and the correction was backported to the stable 5.15 series. Red Hat rated the issue Moderate (CVSS 7.0), released fixes for affected RHEL 8 and RHEL 9 kernel streams, including applicable EUS and kernel-rt packages, and listed RHEL 6 and 7 as unaffected.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, addressing CVE-2023-1252.
Red Hat released RHSA-2023:6583 to fix CVE-2023-1252 in the Red Hat Enterprise Linux 9 kernel stream.
Linux stable 5.15 patch 138 incorporated upstream commit 9a254403760041528bc8f69fe2f5e1ef86950991, adding reference counting to ovl_aio_req to prevent its embedded iocb from being freed before the underlying read/write operation returns.
Red Hat released RHSA-2024:8613 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:8614 for its kernel-rt package, fixing CVE-2023-1252.
Red Hat released RHSA-2024:8107 to address CVE-2023-1252 in the RHEL 8.8 Extended Update Support kernel.
RHSA-2024:0724 fixed CVE-2023-1252 in the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel.
Commit 2406a307ac7 introduced OverlayFS asynchronous I/O routines containing a use-after-free condition in ovl_aio_req. The affected implementation has been present since Linux kernel 5.6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-40047** is a use-after-free vulnerability in the Linux kernel's `io_uring` `IORING_OP_WAITID` operation. A low-privileged local attacker can race cancellation handling in `io_waitid_wait()` because a wait-queue entry may not be pruned after a successful return, permitting repeated callbacks, list corruption, a system crash, or potential privilege escalation. The flaw was introduced in Linux kernel 6.7. The issue is fixed in Linux kernel versions 6.12.53, 6.17.3, and 6.18-rc1; maintainers recommend upgrading to a current stable release rather than cherry-picking the patch. Red Hat rated the vulnerability 7.8 under CVSS v3.1 and released fixes for supported Red Hat Enterprise Linux 9 and 10 kernel streams, while the RHEL 9 `kernel-rt` stream remains affected.
Aug 25, 2026
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
Researchers disclosed **CVE-2021-20226**, a reference-counting bug in the Linux kernel's `io_uring` subsystem that can allow **local privilege escalation to root**. The flaw stems from `io_uring` worker threads retaining and later using a pointer to `current->files` without properly incrementing the `files_struct` reference count, creating unsafe conditions during asynchronous file-descriptor operations. Technical analysis showed the bug can lead to a **use-after-free** involving `struct file`, particularly when `fdget()` does not increment a file object's reference count because `files_struct->count` equals 1 and a worker or calling thread closes the descriptor. Researchers said the issue affects newer Linux kernels that include `io_uring`, noted possible exploitation paths involving asynchronous workers, file-descriptor table reuse, and interaction with `execve` and privileged processes, and reported that the vulnerability was fixed by a kernel commit that correctly increments the `files_struct` reference count.
Aug 1, 2026