Loading story…
CVE-2023-0597 affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive.
The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, addressing CVE-2023-0597.
Red Hat issued RHSA-2023:6583 to fix CVE-2023-0597 in the Red Hat Enterprise Linux 9 kernel.
Peter Zijlstra submitted an x86_64 Linux kernel patch to randomize per-CPU CPU-entry-area placements after Seth Jenkins reported that the mapping remained predictable despite KASLR. The change assigns unique randomized offsets to CPU entry areas mapped for KPTI.
Red Hat issued RHSA-2024:10772 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:10773 for its kernel-rt package, fixing CVE-2023-0597.
Red Hat issued RHSA-2024:10262 to address CVE-2023-0597 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
RHSA-2024:1188 fixed CVE-2023-0597 for the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52619** is a moderate-severity denial-of-service flaw in the Linux kernel's `pstore/ram` subsystem. Systems configured with an odd number of CPU cores can calculate an odd zone size, producing unaligned alternate-zone virtual addresses and potentially crashing the kernel when those addresses are accessed. Exploitation requires a local, authenticated low-privileged attacker and no user interaction; Red Hat rates the issue CVSS 3.1 5.5. The upstream fix aligns the zone size downward with `ALIGN_DOWN()` and is included in Linux stable releases 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8 and later. Red Hat has issued corrected kernel packages for affected RHEL 8 and RHEL 9 streams, including specified EUS and real-time kernels, and advises prompt updates because no practical mitigation is available; unsupported RHEL 6 and 7 kernels should be presumed vulnerable.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026