Loading story…
CVE-2021-47321 is a use-after-free flaw in Linux kernel watchdog drivers. During driver removal, affected code used del_timer(), which could return while an active timer handler continued running; the handler could then access memory freed with the driver, causing system instability or crashes. The upstream fix replaces it with del_timer_sync(), ensuring the handler has finished and cannot reschedule before resources are released.
The correction is included in Linux kernel versions 4.4.276, 4.9.276, 4.14.240, 4.19.198, 5.4.134, 5.10.52, 5.12.19, 5.13.4, 5.14, and later stable releases. Red Hat rated the issue Moderate (CVSS 3.1: 4.4) and issued RHEL 8 and RHEL 8.8 Extended Update Support fixes through RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:8107; RHEL 9 is not affected. Organizations should update affected kernel and kernel-rt packages, as Red Hat identified no practical mitigation.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package, addressing CVE-2021-47321.
Red Hat published its record for CVE-2021-47321, a Linux watchdog-driver use-after-free caused by remove paths using del_timer() without waiting for active timer handlers. The upstream fix replaces del_timer() with del_timer_sync().
Red Hat released RHSA-2024:8107 to fix CVE-2021-47321 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel's `r592` MemoryStick host-controller driver can trigger a use-after-free during device or module removal. The `r592_remove` routine could free the host object while the detect timer was still able to queue work referencing it, enabling a local attacker with specialized peripheral hardware, high privileges, and precise timing to crash the system or potentially expose kernel information. The issue is tracked as **CVE-2023-35825** and **CVE-2023-3141**, with Red Hat assigning a CVSS v3.1 score of 6.4. The upstream fix stops and synchronizes the detect timer with `del_timer_sync(&dev->detect_timer)` before device cleanup, preventing active timer callbacks from accessing freed memory. Red Hat released corrected kernel packages for multiple RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4; RHEL 9 `kernel-rt` remained affected in the referenced advisories, while RHEL 6 and 7 packages were outside support scope. Organizations using affected systems should apply the applicable Red Hat kernel updates, particularly where r592 hardware is present or can be physically attached.
Aug 26, 2026
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026