Loading story…
Linux kernel maintainers resolved CVE-2021-47579, an OverlayFS flaw that can trigger a WARN_ON condition while creating an OverlayFS work directory on a cgroup v2 filesystem. The condition occurs because cgroup2 mkdir can return without instantiating the newly created dentry, leaving ovl_create_real() to encounter an unexpected state.
The remediation calls ovl_mkdir_real() directly from ovl_workdir_create() and rejects the unsupported filesystem behavior earlier in setup. Fixes are available in Linux kernel versions 4.19.222, 5.4.168, 5.10.88, 5.15.11, and later stable releases; Red Hat rated the issue CVSS 4.1 (Low) and released fixes for RHEL 8 and 9 kernel packages, while RHEL 9 kernel-rt remained affected.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, addressing CVE-2021-47579.
Red Hat released RHSA-2024:2394, fixing CVE-2021-47579 in the Red Hat Enterprise Linux 9 kernel package.
The Linux kernel CVE team assigned CVE-2021-47579 to an OverlayFS issue where cgroup2 directory creation can leave a new dentry without an inode and trigger a WARN_ON condition. Upstream fixes route work-directory creation through ovl_mkdir_real() to reject the unsupported condition earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-1252** is a use-after-free flaw in the Linux kernel’s OverlayFS asynchronous I/O path that can be triggered when OverlayFS performs direct asynchronous reads against an underlying Ext4 filesystem. I/O completion on a separate thread can free the embedded `iocb` in `ovl_aio_req` before the lower filesystem returns from its read/write iterator, creating a system-crash and potential local privilege-escalation condition for low-privileged users. The upstream fix adds reference counting to `ovl_aio_req`, retaining the I/O control block until `vfs_read_iter()` or `vfs_write_iter()` returns. The affected OverlayFS AIO implementation was introduced in Linux 5.6, and the correction was backported to the stable 5.15 series. Red Hat rated the issue Moderate (CVSS 7.0), released fixes for affected RHEL 8 and RHEL 9 kernel streams, including applicable EUS and `kernel-rt` packages, and listed RHEL 6 and 7 as unaffected.
Aug 26, 2026
**CVE-2022-24448** affects Linux kernel NFS directory-open handling: an application opening a path on a mounted NFS filesystem with `O_DIRECTORY` could receive an uninitialized file descriptor if the NFS server returned a regular file during lookup, rather than the expected `ENOTDIR` error. The resulting condition can disclose uninitialized kernel data to local, low-privileged users. The upstream NFSv4 fix validates lookup results when `LOOKUP_DIRECTORY` is set and returns `ENOTDIR` for non-directory objects. Red Hat rated the issue **CVSS 3.3 (Low)** and released corrected kernel packages for affected RHEL 8, RHEL 8.6 EUS, RHEL 9, and Red Hat Virtualization 4 on RHEL 8; its RHEL 6 and RHEL 7 kernel variants are marked will not fix.
Aug 26, 2026
**CVE-2023-52622** is an ext4 filesystem vulnerability that can prevent online resizing of filesystems created with an oversized flexible block-group (`flex_bg`) configuration. During resizing, ext4 may attempt to allocate a `new_group_data` array larger than the kernel allocator's `MAX_ORDER` limit, triggering a `WARN_ON` condition and causing the resize operation to fail. Red Hat rates the issue CVSS 3.1 **5.5** (`AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`): a local low-privileged user can cause a high availability impact without user interaction. Upstream Linux fixed the issue by limiting each resize pass to `MAX_RESIZE_BG`—16,384 block groups—and completing larger expansions over multiple iterations, potentially dispersing metadata within a `flex_bg`. Fixes are available in stable kernels 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat released fixes for affected RHEL 8 and RHEL 9 kernel packages through errata issued from August 2024 to May 2025; RHEL 9 `kernel-rt` remains affected, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026