Loading story…
CVE-2023-52619 is a moderate-severity denial-of-service flaw in the Linux kernel's pstore/ram subsystem. Systems configured with an odd number of CPU cores can calculate an odd zone size, producing unaligned alternate-zone virtual addresses and potentially crashing the kernel when those addresses are accessed. Exploitation requires a local, authenticated low-privileged attacker and no user interaction; Red Hat rates the issue CVSS 3.1 5.5.
The upstream fix aligns the zone size downward with ALIGN_DOWN() and is included in Linux stable releases 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8 and later. Red Hat has issued corrected kernel packages for affected RHEL 8 and RHEL 9 streams, including specified EUS and real-time kernels, and advises prompt updates because no practical mitigation is available; unsupported RHEL 6 and 7 kernels should be presumed vulnerable.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, fixing CVE-2023-52619.
Red Hat released RHSA-2024:10771, RHSA-2024:10772, and RHSA-2024:10773, fixing CVE-2023-52619 in the RHEL 9.4 EUS kernel and RHEL 9.2 EUS kernel and kernel-rt streams.
Red Hat released RHSA-2024:9315 to fix CVE-2023-52619 in the RHEL 9 kernel.
Red Hat released RHSA-2024:6206, fixing CVE-2023-52619 in the RHEL 8.8 Extended Update Support kernel.
The Linux kernel CVE team documented CVE-2023-52619 in pstore/ram, where an odd CPU count can create misaligned zone addresses and crash the kernel. Fixes use ALIGN_DOWN() to make zone sizes even and were incorporated into stable versions 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-0597** affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive. The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
Aug 26, 2026
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026