Loading story…
CVE-2023-52817 is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the amdgpu_regs_smc debugfs file while the smc_rreg pointer is NULL, triggering a NULL-pointer dereference in amdgpu_debugfs_regs_smc_read and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5.
The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 kernel-rt was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 standard kernel and RHSA-2024:7001 for the RHEL 8 real-time kernel, addressing CVE-2023-52817.
Mauro Matteo Cascella reported Red Hat bug 2282676 for CVE-2023-52817. Red Hat classified the issue as medium severity and medium priority.
Red Hat released RHSA-2024:2394 to fix CVE-2023-52817 in the standard Red Hat Enterprise Linux 9 kernel.
Red Hat released RHSA-2024:9315 as an additional fixed erratum for the RHEL 9 kernel vulnerability CVE-2023-52817.
The Linux kernel CVE team assigned CVE-2023-52817 to an AMDGPU DRM debugfs NULL-pointer dereference that can be triggered by reading amdgpu_regs_smc on affected GPUs, including VEGA20.
The NULL-pointer dereference was fixed in Linux kernel versions 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7. The fixes prevent an AMDGPU debugfs read from dereferencing a NULL smc_rreg pointer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-41093** is a null-pointer dereference in the Linux kernel's AMDGPU DRM virtual KMS code. A local low-privileged user could trigger a kernel crash and denial of service because the driver accessed `state->fb->obj[0]` without confirming that the framebuffer object existed. The issue is rated Moderate by Red Hat, with a CVSS v3.1 score of 5.5 and high availability impact. The upstream fix replaces the direct object access with `drm_gem_fb_get_obj()` and returns an error when no framebuffer object is present. Corrected upstream kernels include 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10; Red Hat has released updated RHEL 8 and RHEL 9 `kernel` and `kernel-rt` packages, while RHEL 6 and 7 are not affected. Organizations using AMDGPU should deploy the relevant kernel updates and reboot affected hosts.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026