Loading story…
CVE-2021-47289 is a moderate-severity Linux kernel flaw in ACPI device reference handling. A code path introduced by commit 71f642833284 could invoke acpi_dev_put() with a NULL pointer, leading the helper to call put_device() using an invalid offset and potentially crash the host. Red Hat assigned a CVSS v3.1 score of 5.5, reflecting low-complexity local exploitation with high availability impact.
Upstream fixed the issue by making acpi_dev_put() safely handle NULL pointers; fixes are included in kernel versions 5.4.139, 5.10.57, 5.13.6, and 5.14 and later stable releases. Red Hat remediated affected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while RHEL 6 and 7 are outside support scope and should be treated as vulnerable unless otherwise mitigated.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package to address CVE-2021-47289. Red Hat rated the locally triggerable ACPI NULL-pointer dereference as Moderate, with a CVSS v3.1 score of 5.5.
The Linux kernel CVE team assigned CVE-2021-47289 to an ACPI reference-counting flaw in which acpi_dev_put() could receive a NULL pointer and trigger an invalid put_device() call. Upstream fixes make acpi_dev_put() safely accept NULL pointers and are included in kernel versions 5.4.139, 5.10.57, 5.13.6, and 5.14.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26717** is a local denial-of-service flaw in the Linux kernel's Open Firmware (OF) I2C HID driver at `drivers/hid/i2c-hid/i2c-hid-of.c`. Introduced in kernel 5.12 when I2C HID support was split into ACPI and OF implementations, the OF driver can leave a client pointer uninitialized; a failed device power-up can then trigger a NULL-pointer dereference and crash or restart the kernel. The issue is fixed in upstream kernels 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8 and later. Red Hat rated the flaw CVSS 4.4 (low) and released corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support systems; its referenced advisory listed RHEL 9 `kernel-rt` as affected without a corresponding erratum. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2024-26894** is a low-severity Linux kernel flaw in the ACPI processor-idle subsystem. In `acpi_processor_power_exit()`, a CPU idle device is unregistered but its allocated memory is not freed, creating a CWE-401 memory leak. Introduced in kernel version 3.7, the defect can accumulate memory consumption and, under local privileged conditions, degrade reliability or cause denial of service through resource exhaustion or system instability. Red Hat assigned a CVSS v3.1 score of 6.0. Upstream Linux fixed the issue in stable kernels 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1; maintainers recommend updating to a current stable kernel rather than applying only the individual patch. Red Hat released corrected kernel packages for RHEL 8 and RHEL 9, including RHEL 9.4 Extended Update Support, while the RHEL 9 `kernel-rt` package remained affected; RHEL 6 and 7 are outside supported scope.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026