Loading story…
CVE-2021-47393 affects the Linux kernel hwmon subsystem's mlxreg-fan driver. An attacker or local user able to supply an out-of-range minimum fan-speed value through the driver's sysfs interface can trigger a non-zero return condition that prevents thermal-statistics updates and may lead to slab out-of-bounds memory access. The resulting fault can cause kernel instability, unexpected behavior, or denial of service through a system crash.
Red Hat rates the issue CVSS 4.7 (Moderate) and recommends updating affected kernel packages, reporting no practical mitigation. Fixes are available for affected Red Hat Enterprise Linux 8 and 9 kernel variants; Red Hat Enterprise Linux 6 is not affected. The flaw reflects improper handling of exceptional return conditions, categorized as CWE-754, where unhandled error states can create availability and integrity risks.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:7000 and RHSA-2024:7001 for RHEL 8 kernel and kernel-rt packages, and RHSA-2024:6990 and RHSA-2024:6991 for RHEL 9.0 SAP Solutions kernel-rt and kernel packages.
Red Hat issued RHSA-2024:5065 to fix CVE-2021-47393 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Solutions kernel packages.
Red Hat issued RHSA-2023:2458, providing fixed Red Hat Enterprise Linux 9 kernel packages for CVE-2021-47393 in the mlxreg-fan driver.
The Linux kernel CVE team documented CVE-2021-47393 as an out-of-bounds read in the mlxreg-fan driver when an enforced fan state supplied through sysfs exceeds the nominal maximum. It identified fixes in stable kernel releases 4.19.209, 5.4.151, 5.10.71, 5.14.10, and 5.15, and recommended updating to a current stable release.
Red Hat issued RHSA-2024:10262, supplying fixed RHEL 8.8 Extended Update Support kernel packages for CVE-2021-47393.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47560** is a NULL-pointer dereference in the Linux kernel's Mellanox `mlxsw` Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port. Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and `kernel-rt` packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
Aug 26, 2026
**CVE-2023-52658** is a moderate-severity local denial-of-service flaw in the Linux kernel's Mellanox `mlx5` switchdev offload driver. A change intended to block switchdev mode when network namespace state is inconsistent can instead trigger a system crash. The vulnerable change was introduced in Linux 6.3 and backported to Linux 6.1.22 and 6.2.9; fixes revert the change and are included in Linux 6.6.22, 6.7.10, and 6.8. Red Hat rates the issue **CVSS 5.5**: exploitation requires low privileges and affects availability, with no identified confidentiality or integrity impact. Red Hat shipped fixes in RHEL 8 `kernel` and `kernel-rt` updates and the RHEL 9 `kernel` update, while RHEL 9 `kernel-rt` remained listed as affected; organizations using MLX5 adapters in switchdev mode should deploy current vendor kernel updates rather than individually cherry-picking patches.
Aug 26, 2026
**CVE-2025-39973** affects the Linux kernel’s Intel i40e Ethernet driver: a malicious virtual function can provide an oversized or misaligned `ring_len` value that is passed to a hardware memory context without adequate validation. The condition can create excessive transmit or receive queue lengths, potentially resulting in memory corruption or undefined behavior. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.5, while CVE.org assigns 8.8 under different environmental assumptions; RHEL 7 through 10, including applicable real-time kernels, are listed as affected, while RHEL 6 is not affected. The defect aligns with **CWE-131**, incorrect calculation of buffer size, a memory-safety weakness that can lead to out-of-bounds access, crashes, sensitive-data exposure, or code execution. Red Hat’s RHSA-2025:21469 provides updated RHEL 9 kernel packages for multiple kernel security issues and requires a reboot after installation; however, Red Hat’s CVE record separately reports no qualifying mitigation for CVE-2025-39973. Organizations should identify systems using affected i40e hardware and virtual-function configurations, apply applicable vendor kernel updates, reboot hosts, and restrict untrusted VF access where operationally possible.
Aug 25, 2026