Loading story…
CVE-2021-47257 is a Linux kernel flaw in net/ieee802154/nl802154.c that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact.
The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 kernel and kernel-rt packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for affected Red Hat Enterprise Linux 8 kernel packages and RHSA-2024:5102 for RHEL 8 kernel-rt packages, correcting the IEEE 802.15.4 device-address parsing logic.
Linux kernel stable releases 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 fixed CVE-2021-47257 in net/ieee802154/nl802154.c. The flaw allowed an invalid address mode to trigger a NULL-pointer dereference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-42754** is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an `sk_buff` may lack an associated network device, but `ipv4_send_dest_unreach()` assumes `skb->dev` is present and dereferences it through `dev_net(skb->dev)`, triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel. The upstream correction, commit `0113d9c9d1ccc07f5a3710dac4aa24b6d711278c`, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 `kernel-rt` remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 `kernel-rt` are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
Aug 26, 2026
**CVE-2021-47560** is a NULL-pointer dereference in the Linux kernel's Mellanox `mlxsw` Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port. Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and `kernel-rt` packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
Aug 26, 2026
**CVE-2021-47468** affects the Linux kernel's mISDN NetJet ISDN driver, where `card->isac.release()` can be invoked while a lock is held in an atomic context. Because the release path may sleep, a local attacker able to exercise the affected device-removal path could trigger a kernel fault or denial of service. The upstream fix defers the release-function call until after the lock has been released. The fix was backported to stable kernels including 4.4.290, 4.9.288, 4.14.253, 4.19.214, 5.4.156, 5.10.76, 5.14.15, and 5.15. Red Hat rated the flaw Low severity (CVSS 4.4) and released RHEL 8 kernel updates through advisories including **RHSA-2024:5101** and **RHSA-2024:5102**; RHEL 9 is not affected. Organizations should deploy their vendor's current kernel updates rather than cherry-picking the upstream patch.
Aug 26, 2026