Loading story…
CVE-2024-26880 is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically drivers/md/dm.c, that can corrupt an internal list and trigger a kernel BUG or system crash in the dm_snapshot path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call origin_postsuspend twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact.
The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 kernel-rt was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released fixes for the RHEL 8 kernel and kernel-rt packages in RHSA-2024:7000 and RHSA-2024:7001.
Red Hat released a fix for the RHEL 9 kernel package in RHSA-2024:4928.
Red Hat released fixes for the RHEL 9.2 Extended Update Support kernel and kernel-rt packages through RHSA-2024:4823 and RHSA-2024:4831.
Fixes were made available in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1. The remediation makes internal resume invoke target preresume and resume methods to preserve suspend/resume pairing.
The device-mapper internal-suspend flaw was introduced in Linux kernel 3.19, in drivers/md/dm.c, by commit ffcc39364160. Incorrect pairing of postsuspend and resume handling could cause a second origin_postsuspend call, list corruption, and a kernel crash.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CVE-2024-26638 is a low-severity flaw in the Linux kernel's Network Block Device (NBD) driver, introduced in kernel version 5.19. Incomplete initialization of a `struct msghdr` in the NBD reply-receive path can expose the uninitialized `msg_get_inq` field during `tcp_recvmsg` processing, triggering a KMSAN uninitialized-value error and affecting system availability. Exploitation requires local access and high privileges; Red Hat assigns a CVSS 3.1 score of 4.4. The upstream issue is fixed in Linux 6.1.76, 6.6.15, 6.7.3, 6.8, and later stable releases. Red Hat has issued fixes for affected Red Hat Enterprise Linux 8, RHEL 9, and RHEL 9.4 Extended Update Support packages, while RHEL 8 and RHEL 9 real-time kernels remain affected; unsupported RHEL 6 and 7 variants should be considered potentially affected. Organizations should update to vendor-supported current kernel releases rather than cherry-picking the individual upstream patch.
Aug 26, 2026
A flaw tracked as **CVE-2025-37861** affects the Linux kernel's `scsi: mpi3mr` driver, where improper synchronization between the reset thread and the task management thread can expose an invalid reply queue ID of `0xFFFF` during controller reset. That race can cause the task management path to reference unallocated memory and trigger a kernel crash, making the issue a denial-of-service risk. Red Hat rated the bug **Moderate** with a **CVSS 6.3**, while NVD and CVE.org scored it **7.8**; Red Hat said exploitation requires local access with a special group privilege and noted no integrity impact in the known use case. Upstream Linux fixed the bug by adding an `io_admin_reset_sync` flag to coordinate reset, I/O, and admin thread access to reply queues, block processing during reset, and mark the controller unrecoverable if synchronization does not complete within 10 seconds. The Linux kernel CVE team said the issue is resolved in versions **6.12.24**, **6.13.12**, **6.14.3**, and **6.15-rc1**, and advised users to move to the latest stable kernel release. Red Hat also shipped fixes across multiple **Red Hat Enterprise Linux 9** variants, including `kernel-rt` updates in advisory **RHSA-2026:3358**, while stating **RHEL 10** is affected and **RHEL 6** and **RHEL 7** kernel packages are not affected because the vulnerable code is absent.
Aug 25, 2026
**CVE-2023-52817** is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the `amdgpu_regs_smc` debugfs file while the `smc_rreg` pointer is NULL, triggering a NULL-pointer dereference in `amdgpu_debugfs_regs_smc_read` and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5. The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 `kernel-rt` was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
Aug 26, 2026