Loading story…
A race condition in the Linux kernel's r592 MemoryStick host-controller driver can trigger a use-after-free during device or module removal. The r592_remove routine could free the host object while the detect timer was still able to queue work referencing it, enabling a local attacker with specialized peripheral hardware, high privileges, and precise timing to crash the system or potentially expose kernel information. The issue is tracked as CVE-2023-35825 and CVE-2023-3141, with Red Hat assigning a CVSS v3.1 score of 6.4.
The upstream fix stops and synchronizes the detect timer with del_timer_sync(&dev->detect_timer) before device cleanup, preventing active timer callbacks from accessing freed memory. Red Hat released corrected kernel packages for multiple RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4; RHEL 9 kernel-rt remained affected in the referenced advisories, while RHEL 6 and 7 packages were outside support scope. Organizations using affected systems should apply the applicable Red Hat kernel updates, particularly where r592 hardware is present or can be physically attached.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, addressing the r592 use-after-free vulnerability.
Red Hat released RHSA-2023:6583, fixing the r592 use-after-free issue tracked as CVE-2023-35825 and CVE-2023-3141 in the RHEL 9 kernel.
Red Hat published CVE-2023-35825 for the r592 device-driver race condition, which can lead to a use-after-free and system crash or other undefined behavior.
Zheng Wang submitted a Linux kernel patch to fix a use-after-free race in the r592 MemoryStick host-controller driver's r592_remove cleanup path. The patch synchronizes and stops the detect timer before device cleanup.
Red Hat released RHSA-2024:0724, fixing the r592 vulnerability in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat released RHSA-2024:0575 to fix the r592 vulnerability in the RHEL 8.8 Extended Update Support kernel.
Ulf Hansson accepted the r592 driver patch for the Linux kernel's next branch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
Red Hat addressed **CVE-2021-47287**, a Linux kernel driver-core flaw in `drivers/base/auxiliary.c` that leaks memory when `driver_register()` fails. In the affected `__auxiliary_driver_register()` path, memory allocated for `auxdrv->driver.name` was not released before the function returned, creating a local denial-of-service risk through resource exhaustion. Red Hat assigns the issue a CVSS 3.1 score of 5.5 (medium), with low-privilege local access required and availability as the affected security property. The defect was introduced in Linux kernel 5.11 and fixed upstream in versions 5.13.6 and 5.14. Red Hat released fixes for affected RHEL 8 `kernel` and `kernel-rt` packages through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as not affected. Organizations running affected RHEL 8 systems should apply the advisory updates and reboot into the updated kernel; upstream recommends using the latest stable kernel release rather than cherry-picking the patch.
Aug 26, 2026
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026