Loading story…
CVE-2021-47383 is a moderate-severity out-of-bounds read flaw in the Linux kernel framebuffer-console (tty) subsystem's imageblit function. A local low-privileged process can trigger invalid vmalloc memory access through an FBIOPUT_VSCREENINFO ioctl request containing only partially populated fb_var_screeninfo fields, including xres, yres, and bits_per_pixel. If the requested configuration matches the prior request, the kernel can skip resize_screen(), leaving display values incomplete and producing incorrect row and coordinate calculations that lead to the invalid access, system crashes, or instability.
The upstream fix forces resize_screen() to populate the structure even where no display resize is needed; corrected releases span kernel versions from 4.4.286 through 5.15. Red Hat rated the issue CVSS 6.6 (CWE-125) and issued fixes for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support kernel packages. Organizations should deploy updated kernel packages; no practical workaround was identified. RHEL 9 kernel-rt remained affected in the advisory, while RHEL 7 packages were outside support scope.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package, addressing CVE-2021-47383.
Red Hat released RHSA-2024:5364 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:5365 for its kernel-rt variant, fixing CVE-2021-47383.
Red Hat released RHSA-2024:8617, fixing CVE-2021-47383 in the RHEL 9 kernel. The RHEL 9 kernel-rt package remained listed as affected without a corresponding erratum.
Linux kernel stable releases 4.4.286, 4.9.285, 4.14.249, 4.19.209, 5.4.151, 5.10.71, 5.14.10, and 5.15 incorporated fixes for CVE-2021-47383. The remediation ensures resize_screen() completes fb_var_screeninfo even when a display resize is not required, preventing the out-of-bounds vmalloc access in imageblit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
A memory-corruption vulnerability in the Linux kernel Framebuffer Console (`fbcon`), tracked as **CVE-2023-38409**, can allow a low-privileged local attacker to crash an affected system. Red Hat rates the flaw as moderate severity (CVSS 3.1: 5.5) and classifies it as CWE-129, improper validation of an array index; affected Red Hat Enterprise Linux 7 and 8 kernel and real-time kernel packages received security updates. The defect affects kernels from version 5.19 and stems from `set_con2fb_map()` updating the `con2fb_map` framebuffer mapping only for the first virtual console it takes over. That behavior can leave framebuffer structures out of sync during mode deletion and trigger the memory-safety condition identified through KASAN. Linux fixed the issue in commit `fffb0b52d5258554c645c966c6cbef7de50b851d`; organizations should apply vendor kernel updates, or where patching is not immediately possible, prevent the `fbcon` module from loading by blacklisting it.
Aug 26, 2026
Red Hat released **Important** Linux kernel updates for **RHEL 9** under `RHSA-2026:57252`, addressing **26 CVEs** across subsystems including **netfilter, DRM/AMD GPU drivers, SMB client, iSCSI target, memfd, UDF, SMC, and POSIX CPU timers**. The advisory highlights memory-safety issues such as buffer overflows, out-of-bounds reads and writes, use-after-free, double-free, and validation flaws, and requires affected systems to be **rebooted after patching**. Downstream distributions and vendors including **Oracle Linux, Rocky Linux, AlmaLinux, and Unity Linux** published corresponding kernel notices and scanner coverage, with several notices indicating **local exploitation** risk and, in some cases, that **exploits are available**. Two AMD-related kernel flaws illustrate the update set: **`CVE-2026-45878`** in `drm/amdkfd` fixed inconsistent signed/unsigned handling of a userspace-supplied `watch_id`, which could trigger invalid bit shifts, out-of-bounds access to the `watch_points` array, and a buffer overflow; and **`CVE-2026-53329`** in `drm/amd/display` replaced `krealloc()` with `krealloc_array()` to prevent integer-overflow-driven undersized allocations that could lead to heap overflows during vector growth. The weaknesses align with well-known classes such as **`CWE-131`** (incorrect calculation of buffer size), **`CWE-120`** (classic buffer overflow), and in some bundled advisories **`CWE-279`** (incorrect execution-assigned permissions), underscoring the need to prioritize kernel package updates across supported enterprise Linux fleets.
Aug 22, 2026