Loading story…
CVE-2023-52470 affects the Linux kernel DRM/Radeon driver because radeon_crtc_init() did not validate the result of alloc_workqueue() when creating its flip_queue. Under an allocation failure, initialization could continue with a NULL workqueue pointer, causing a kernel null-pointer dereference and allowing a local denial of service through a crash, restart, or process exit. Red Hat rates the flaw Low severity (CVSS 3.1: 4.4); confidentiality and integrity are not affected, but availability impact is high.
Upstream and stable kernel patches now allocate and validate the workqueue before DRM CRTC initialization, free the Radeon CRTC object if allocation fails, and exit safely. The fix is included in Linux stable releases, including Fedora's 6.6.16 update. Red Hat issued fixes for standard and real-time RHEL 8 kernels and the standard RHEL 9 kernel; RHEL 6 and 7 variants remained under investigation, while the RHEL 9 real-time kernel fix was deferred.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 real-time kernel to address CVE-2023-52470.
Red Hat released RHSA-2024:2394 for the standard Red Hat Enterprise Linux 9 kernel, addressing CVE-2023-52470.
Yang Yingliang authored a DRM/Radeon fix that checks whether alloc_workqueue() succeeded in radeon_crtc_init(), freeing the Radeon CRTC object and returning safely if allocation fails.
Greg Kroah-Hartman committed stable Linux backports of the Radeon fix, preventing initialization from continuing with a NULL flip_queue after workqueue allocation failure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-41093** is a null-pointer dereference in the Linux kernel's AMDGPU DRM virtual KMS code. A local low-privileged user could trigger a kernel crash and denial of service because the driver accessed `state->fb->obj[0]` without confirming that the framebuffer object existed. The issue is rated Moderate by Red Hat, with a CVSS v3.1 score of 5.5 and high availability impact. The upstream fix replaces the direct object access with `drm_gem_fb_get_obj()` and returns an error when no framebuffer object is present. Corrected upstream kernels include 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10; Red Hat has released updated RHEL 8 and RHEL 9 `kernel` and `kernel-rt` packages, while RHEL 6 and 7 are not affected. Organizations using AMDGPU should deploy the relevant kernel updates and reboot affected hosts.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026
**CVE-2023-52817** is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the `amdgpu_regs_smc` debugfs file while the `smc_rreg` pointer is NULL, triggering a NULL-pointer dereference in `amdgpu_debugfs_regs_smc_read` and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5. The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 `kernel-rt` was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
Aug 26, 2026