Loading story…
CVE-2022-25265 is a Linux kernel executable-space-protection bypass affecting kernels through 5.16.10. On x86_64 systems, a deliberately crafted 32-bit ELF executable that omits the PT_GNU_STACK header can be treated as requiring an executable stack, allowing code execution from file-backed regions that should be non-executable. The condition affects certain legacy binaries, including software built with GCC 3.2.2-era toolchains for systems without NX support; 64-bit executables are not affected.
A public proof of concept demonstrated building such a binary on Slackware 9 with Linux 2.4.20 and running machine code copied into a character buffer on a modern Linux 5.16.1 system, producing effectively RWX mapped memory. Red Hat rated the issue CVSS 7.8 and issued RHEL 8 kernel and real-time kernel fixes through RHSA-2023:2736, RHSA-2023:2951, and RHSA-2024:0724 for RHEL 8.6 EUS. RHEL 6 and 7 are unsupported, while RHEL 9 does not support 32-bit binaries; organizations should apply applicable kernel errata and identify legacy 32-bit ELF workloads.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2736 for the RHEL 8 kernel-rt package and RHSA-2023:2951 for the RHEL 8 kernel package to address CVE-2022-25265. Red Hat also closed Bug 2055499.
Sandipan Roy reported CVE-2022-25265, a Linux kernel issue in which certain legacy ELF binaries can receive an exec-all attribute and execute bytes in nominally non-executable file regions.
A proof of concept built with GCC 3.2.2 on Slackware 9/Linux 2.4.20 demonstrated that a legacy binary lacking PT_GNU_STACK could execute machine code copied into a character buffer on a modern Linux 5.16.1 system.
Red Hat issued RHSA-2024:0724 to address CVE-2022-25265 for the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux fixed **CVE-2016-3672**, a flaw that allowed users on x86 systems to disable Address Space Layout Randomization (ASLR) when launching 32-bit applications by setting the `RLIMIT_STACK` resource limit to unlimited. The issue was reported by Hector Marco-Gisbert and affected then-current Linux systems. By disabling ASLR, the condition made process memory locations predictable and weakened a key exploit mitigation, increasing the reliability of memory-corruption attacks. Organizations running affected Linux kernels should apply the available kernel updates, particularly where untrusted users can execute 32-bit binaries.
Aug 28, 2026
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026