Loading story…
CVE-2022-49977 is a Linux kernel ftrace flaw that can trigger a NULL-pointer dereference and kernel OOPS after ftrace is disabled following a failed startup-enable operation. A failed ftrace_startup_enable can leave an operation registered in ftrace_ops_list; because unregister_ftrace_function exits early when ftrace_disabled is set, a later access can dereference a freed dynamically allocated operation in is_ftrace_trampoline. Syzkaller reproduced the crash on Linux 5.10.0.
The defect is fixed in stable kernel versions 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7, and 6.0 and later. Red Hat rated the issue Moderate with a CVSS v3.1 score of 7.0 and released corrected kernel and kernel-rt packages for Red Hat Enterprise Linux 8 and applicable extended-support variants; organizations should update affected kernels to vendor-supported fixed releases.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:11850 for the RHEL 8 kernel package and RHSA-2025:11851 for the RHEL 8 kernel-rt package, addressing CVE-2022-49977.
Red Hat issued RHSA-2025:15035 with fixes for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
Red Hat issued RHSA-2025:14692 with fixes for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2025:14742 to fix CVE-2022-49977 for RHEL 8.2 Advanced Update Support.
Red Hat issued RHSA-2025:14511 with fixes for RHEL 8.8 Telecommunications Update Service and Update Services for SAP Solutions.
The issue was fixed in stable kernel versions 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7, and 6.0. The fix rolls back registration and removes the ftrace operation from ftrace_ops_list when ftrace_startup_enable fails.
The Linux kernel CVE team assigned CVE-2022-49977 for an ftrace flaw in kernel/trace/ftrace.c that can leave a freed ftrace operation on ftrace_ops_list and trigger a NULL-pointer dereference in is_ftrace_trampoline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-36489** affects the Linux kernel TLS subsystem because `tls_init()` lacked a write memory barrier. On systems permitting store-store reordering, TLS `setsockopt` or `getsockopt` operations can observe an uninitialized `ctx->sk_proto` value and trigger a NULL-pointer dereference, creating an availability risk. Red Hat rates the flaw Low severity, with a product-specific CVSS v3.1 score of 6.1; NVD scores it 5.5. Upstream fixes are available in Linux kernel versions 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.4, and 6.10-rc1. Red Hat issued errata for affected RHEL 8 and RHEL 9 kernel and kernel-rt streams, including relevant EUS and specialized-support offerings, while RHEL 6 is not affected. Organizations should identify hosts running affected kernel builds and apply the applicable vendor kernel updates.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026