Loading story…
A memory-corruption vulnerability in the Linux kernel Framebuffer Console (fbcon), tracked as CVE-2023-38409, can allow a low-privileged local attacker to crash an affected system. Red Hat rates the flaw as moderate severity (CVSS 3.1: 5.5) and classifies it as CWE-129, improper validation of an array index; affected Red Hat Enterprise Linux 7 and 8 kernel and real-time kernel packages received security updates.
The defect affects kernels from version 5.19 and stems from set_con2fb_map() updating the con2fb_map framebuffer mapping only for the first virtual console it takes over. That behavior can leave framebuffer structures out of sync during mode deletion and trigger the memory-safety condition identified through KASAN. Linux fixed the issue in commit fffb0b52d5258554c645c966c6cbef7de50b851d; organizations should apply vendor kernel updates, or where patching is not immediately possible, prevent the fbcon module from loading by blacklisting it.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:1332 to fix CVE-2023-38409 in Red Hat Enterprise Linux 7 kernel-rt packages.
Red Hat issued RHSA-2024:1249 for RHEL 7 kernel packages and RHSA-2024:1268 for RHEL 8.2 kernel packages under multiple update services, fixing CVE-2023-38409.
Red Hat issued RHSA-2024:0562 for RHEL 8.4 Advanced Mission Critical Update Support kernel packages and RHSA-2024:0563 for RHEL 8.4 Telecommunications Update Service kernel-rt packages, addressing CVE-2023-38409.
Red Hat issued RHSA-2024:3138 for RHEL 8 kernel packages and RHSA-2024:2950 for RHEL 8 kernel-rt packages, addressing the fbcon memory-corruption vulnerability.
Linux committed fffb0b52d5258554c645c966c6cbef7de50b851d to correct set_con2fb_map() so it updates con2fb_map for every applicable virtual console, preventing framebuffer mapping arrays from falling out of sync. The patch, authored by Daniel Vetter, was marked for stable branches beginning with Linux v5.19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47383** is a moderate-severity out-of-bounds read flaw in the Linux kernel framebuffer-console (`tty`) subsystem's `imageblit` function. A local low-privileged process can trigger invalid `vmalloc` memory access through an `FBIOPUT_VSCREENINFO` ioctl request containing only partially populated `fb_var_screeninfo` fields, including `xres`, `yres`, and `bits_per_pixel`. If the requested configuration matches the prior request, the kernel can skip `resize_screen()`, leaving display values incomplete and producing incorrect row and coordinate calculations that lead to the invalid access, system crashes, or instability. The upstream fix forces `resize_screen()` to populate the structure even where no display resize is needed; corrected releases span kernel versions from 4.4.286 through 5.15. Red Hat rated the issue CVSS 6.6 (`CWE-125`) and issued fixes for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support kernel packages. Organizations should deploy updated kernel packages; no practical workaround was identified. RHEL 9 `kernel-rt` remained affected in the advisory, while RHEL 7 packages were outside support scope.
Aug 26, 2026
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026