Loading story…
CVE-2023-51043 is a use-after-free flaw in the Linux kernel DRM atomic modesetting subsystem. A local low-privileged attacker can race a nonblocking atomic display commit against unloading or removing a graphics driver, allowing the asynchronous commit to outlive the drm_device reference inherited from its ioctl context. Successful exploitation can cause denial of service or potentially local privilege escalation; Red Hat assigns a CVSS v3.1 score of 7.0.
The issue affects kernels before version 6.4.5 and was fixed upstream in commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255, which makes each drm_atomic_state retain a drm_device reference until the atomic state is freed. Red Hat identified affected RHEL 8 and 9, including selected Extended Update Support, real-time kernel, and Red Hat Virtualization releases, and issued kernel updates. Organizations should deploy the applicable kernel updates; where patching is not immediately possible, Red Hat recommends preventing the DRM kernel module from loading.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:2394, providing RHEL 9 kernel updates that address CVE-2023-51043.
Red Hat issued RHSA-2024:1404, providing a kernel update that fixes CVE-2023-51043 for RHEL 8.8 Extended Update Support.
Red Hat issued RHSA-2024:1188 with a fixed kernel for RHEL 8.6 Extended Update Support; the update also covered Red Hat Virtualization 4 for RHEL 8.
Red Hat issued RHSA-2024:1018 and RHSA-2024:1019, delivering kernel and kernel-rt fixes for RHEL 9.2 Extended Update Support.
Rohit Keshri reported the Red Hat bug record for CVE-2023-51043.
Red Hat issued RHSA-2023:7077, providing RHEL 8 kernel updates that fix CVE-2023-51043, a DRM atomic modesetting use-after-free vulnerability.
Linus Torvalds committed upstream Linux patch 4e076c73e4f6e90816b30fcd4a0d7ab365087255, which makes DRM atomic states retain a drm_device reference to prevent a nonblocking commit from outliving a graphics-driver unload or removal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2025-22097** affects the Linux kernel's DRM Virtual Kernel Mode Setting (VKMS) driver (`drivers/gpu/drm/vkms/vkms_drv.c`). A failed driver initialization can cause `vkms_exit()` to access an uninitialized or already freed `default_config` pointer, creating a use-after-free or possible double-free condition. The flaw was introduced in Linux kernel 5.12. The issue is fixed in stable kernels 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, and 6.15-rc1, and organizations should deploy a current stable kernel or applicable vendor errata. Red Hat rated the vulnerability moderate severity with CVSS 6.7, versus CVE.org's 7.8; Red Hat said an unprivileged local user cannot intentionally force VKMS initialization failure in its supplied configurations and released errata for multiple RHEL versions.
Aug 26, 2026
**CVE-2023-52470** affects the Linux kernel DRM/Radeon driver because `radeon_crtc_init()` did not validate the result of `alloc_workqueue()` when creating its `flip_queue`. Under an allocation failure, initialization could continue with a NULL workqueue pointer, causing a kernel null-pointer dereference and allowing a local denial of service through a crash, restart, or process exit. Red Hat rates the flaw Low severity (CVSS 3.1: 4.4); confidentiality and integrity are not affected, but availability impact is high. Upstream and stable kernel patches now allocate and validate the workqueue before DRM CRTC initialization, free the Radeon CRTC object if allocation fails, and exit safely. The fix is included in Linux stable releases, including Fedora's 6.6.16 update. Red Hat issued fixes for standard and real-time RHEL 8 kernels and the standard RHEL 9 kernel; RHEL 6 and 7 variants remained under investigation, while the RHEL 9 real-time kernel fix was deferred.
Aug 26, 2026