Loading story…
CVE-2023-1637 affects Linux kernel x86 power management: after a suspend-to-RAM (S3) resume, the boot CPU may fail to restore model-specific registers (MSRs) that control speculative-execution mitigations. Secondary CPUs restore the relevant state through identify_secondary_cpu(), but the boot CPU can resume without the intended protections, enabling a local authenticated attacker to potentially access CPU memory and creating a high confidentiality impact.
The upstream fix saves and restores Intel and AMD speculation-control MSRs through pm_save_spec_msr() during processor-state restoration and was designated for stable-kernel backports. Red Hat rated the issue moderate (CVSS 3.1 5.5; AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and released corrected kernel and kernel-rt packages for affected RHEL 8 and RHEL 9 streams; Fedora had addressed it in stable 5.16.20 kernel updates.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:5244 for the RHEL 8 kernel and RHSA-2023:5255 for RHEL 8 kernel-rt, fixing the S3-resume speculative-MSR flaw.
Red Hat issued RHSA-2023:5069 and RHSA-2023:5091 to remediate CVE-2023-1637 in RHEL 9 kernel and kernel-rt packages.
Red Hat released RHSA-2023:4789 to fix affected kernel packages for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
Pawan Gupta authored a Linux kernel patch to save and restore speculation-related MSRs during suspend-to-RAM resume, addressing missing boot-CPU mitigation state after S3 resume.
Red Hat issued RHSA-2023:5794 to remediate CVE-2023-1637 in the RHEL 8.4 Telecommunications Update Service kernel-rt package.
RHSA-2023:5628 fixed CVE-2023-1637 in RHEL 8.4 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service kernel packages.
Linus Torvalds committed e2a1256b17b16f9b9adf1b6fea56819e7b68e463, adding pm_save_spec_msr() to preserve and restore Intel and AMD speculation-control MSRs during S3 resume. The patch was marked for stable-kernel consideration.
glibc committed 1e000d3d33211d5a954300e2a69b90f93f18a1a1 to blacklist additional Intel CPUs for TSX handling, including model 0x8e stepping 0x0c, disabling TSX and enabling RTM_ALWAYS_ABORT. The change fixed the observed glibc feature-test failures and was included in glibc 2.35 and backported to older release branches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcesourceware.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-0597** affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive. The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
Aug 26, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
**CVE-2023-52619** is a moderate-severity denial-of-service flaw in the Linux kernel's `pstore/ram` subsystem. Systems configured with an odd number of CPU cores can calculate an odd zone size, producing unaligned alternate-zone virtual addresses and potentially crashing the kernel when those addresses are accessed. Exploitation requires a local, authenticated low-privileged attacker and no user interaction; Red Hat rates the issue CVSS 3.1 5.5. The upstream fix aligns the zone size downward with `ALIGN_DOWN()` and is included in Linux stable releases 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8 and later. Red Hat has issued corrected kernel packages for affected RHEL 8 and RHEL 9 streams, including specified EUS and real-time kernels, and advises prompt updates because no practical mitigation is available; unsupported RHEL 6 and 7 kernels should be presumed vulnerable.
Aug 26, 2026