Loading story…
CVE-2022-48760 is a Linux kernel USB-core synchronization flaw that can leave processes indefinitely blocked in usb_kill_urb() on SMP systems. Insufficient memory ordering between concurrent usb_kill_urb() and __usb_hcd_giveback_urb() operations can cause a USB request block completion wake-up to be missed; equivalent store-buffering patterns also affect usb_poison_urb() and the failure path of usb_hcd_submit_urb().
The upstream fix adds full memory barriers through smp_mb__after_atomic() and is available in kernel versions 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17 or later. Red Hat rated the issue Low severity (CVSS 4.1) and released RHEL 8 kernel and kernel-rt updates in RHSA-2024:7000 and RHSA-2024:7001; RHEL 9 fixes remain deferred, while RHEL 6 and 7 are outside support scope.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt to remediate CVE-2022-48760.
The Linux kernel CVE team published CVE-2022-48760 for an SMP memory-ordering flaw in the USB core that can leave processes indefinitely waiting in usb_kill_urb(). The disclosure documented memory-barrier fixes, including smp_mb__after_atomic(), and identified fixed stable kernel versions from 4.4.302 through 5.17 and later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47582** affects the Linux kernel USB core's `USBDEVFS_CONTROL` and `USBDEVFS_BULK` ioctl paths in `drivers/usb/core/devio.c`. A local low-privileged user can issue requests with an excessively large timeout to an unresponsive USB device, leaving kernel tasks in uninterruptible waits long enough to trigger hung-task warnings and cause a denial-of-service condition. Red Hat rates the flaw as Low severity with a CVSS v3.1 score of 3.3. The upstream fix replaces the affected `usb_control_msg()` and `usb_bulk_msg()` usage with purpose-built logic using killable waits and `GFP_KERNEL` allocation, making `do_proc_control()` and `do_proc_bulk()` interruptible. The issue was fixed upstream in Linux 5.15.11 and 5.16; Red Hat shipped corrected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while fixes for RHEL 9 were deferred.
Aug 26, 2026
**CVE-2021-47527** affects the Linux kernel serial core (`drivers/tty/serial/serial_core.c`) because a UART transmit buffer was not freed and reset when a port was finally closed after conversion to `tty_port_close()`. A local low-privileged user could subsequently cause operations waiting for the buffer to drain to hang indefinitely, transmit stale buffered data after a port restart, or leak memory if an open serial-port driver is unbound. Red Hat rates the uncontrolled-resource-consumption issue as CVSS 5.5, with availability impact as the primary risk. The flaw was introduced in Linux kernel 4.9 and fixed upstream in versions 4.9.292, 4.14.257, 4.19.220, 5.4.164, 5.10.84, 5.15.7, and 5.16. Red Hat shipped fixes for affected RHEL 8 kernel and `kernel-rt` packages in advisories RHSA-2024:7000 and RHSA-2024:7001, and later addressed RHEL 9.4 Extended Update Support; RHEL 9 kernel and `kernel-rt` packages remained listed as affected in the referenced Red Hat status.
Aug 26, 2026
Red Hat remediated **CVE-2023-1073**, a moderate-severity Linux kernel flaw in the Human Interface Device (HID) subsystem. A locally authenticated, low-privilege attacker with physical access could attach a crafted USB HID device whose descriptor creates an empty report list, causing `hid_validate_values()` to invoke `list_entry()` on an invalid entry. The resulting type confusion can produce an out-of-bounds write and memory corruption, potentially causing a system crash or local privilege escalation; Red Hat assigned CVSS 6.6. The underlying HID report-list issues were reported in `hid_validate_values()` and `bigben_probe()`, and upstream patches added checks requiring non-empty lists before the entries are used. The fix landed upstream in Linux 6.1.9 and was distributed through Fedora stable updates. Red Hat released corrected kernel packages for RHEL 8 and 9, relevant RHEL 8 Extended Update Support streams, kernel-rt packages, and Red Hat Virtualization 4 on RHEL 8; the RHEL 8.8 EUS kernel update `4.18.0-477.43.1.el8_8` includes the remediation. Administrators should apply the applicable kernel update and reboot systems to activate it; RHEL 6 is not affected and RHEL 7 is outside support scope.
Aug 26, 2026