Loading story…
CVE-2021-47338 is a use-after-free flaw in the Linux kernel framebuffer-memory (fbmem) subsystem. When fb_delete_videomode() deletes a video mode still in use, it fails to honor the result of fbcon_mode_deleted(), leaving later framebuffer ioctl handling able to access freed memory in fb_mode_is_equal(). The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN.
Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 kernel and kernel-rt packages were corrected through RHSA-2024:7000 and RHSA-2024:7001; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the affected RHEL 8 kernel and RHSA-2024:7001 for the affected RHEL 8 kernel-rt package, addressing CVE-2021-47338.
Red Hat reported and tracked CVE-2021-47338, classifying the Linux fbmem use-after-free issue with medium priority and medium severity.
The Linux kernel CVE team assigned CVE-2021-47338 to an fbmem flaw in which fb_delete_videomode() could delete a video mode still in use, resulting in a use-after-free. The issue was introduced in Linux kernel version 5.3 and fixed in stable versions 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat remediated **CVE-2022-42703**, a moderate-severity Linux kernel memory-management flaw in `mm/rmap.c` involving incorrect double reuse of a leaf `anon_vma` in `is_mergeable_anon_vma()`. An unprivileged local attacker could repeatedly invoke fork and memory operations to trigger a use-after-free and memory leak, causing a system crash. The issue affects kernels before version 5.19.7; upstream fixed it in commit `2555283eb40df89945557273121e9393ef9b542b`. Red Hat rated the flaw CVSS 3.1 **5.5**, with high availability impact and no assessed confidentiality or integrity impact. Fixes were issued for RHEL 7, 8, 8.6 Extended Update Support, 9, 9.0 Extended Update Support, and Red Hat Virtualization 4 on RHEL 8; Fedora incorporated the stable 5.19.7 kernel fix. RHSA-2023:3388 delivered the fix for RHEL 8.6 EUS alongside patches for three other kernel vulnerabilities. Organizations should install the applicable updated kernel packages and reboot affected systems; Red Hat identified no separate supported mitigation.
Aug 26, 2026
**CVE-2021-47383** is a moderate-severity out-of-bounds read flaw in the Linux kernel framebuffer-console (`tty`) subsystem's `imageblit` function. A local low-privileged process can trigger invalid `vmalloc` memory access through an `FBIOPUT_VSCREENINFO` ioctl request containing only partially populated `fb_var_screeninfo` fields, including `xres`, `yres`, and `bits_per_pixel`. If the requested configuration matches the prior request, the kernel can skip `resize_screen()`, leaving display values incomplete and producing incorrect row and coordinate calculations that lead to the invalid access, system crashes, or instability. The upstream fix forces `resize_screen()` to populate the structure even where no display resize is needed; corrected releases span kernel versions from 4.4.286 through 5.15. Red Hat rated the issue CVSS 6.6 (`CWE-125`) and issued fixes for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support kernel packages. Organizations should deploy updated kernel packages; no practical workaround was identified. RHEL 9 `kernel-rt` remained affected in the advisory, while RHEL 7 packages were outside support scope.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026