Loading story…
CVE-2024-26638 is a low-severity flaw in the Linux kernel's Network Block Device (NBD) driver, introduced in kernel version 5.19. Incomplete initialization of a struct msghdr in the NBD reply-receive path can expose the uninitialized msg_get_inq field during tcp_recvmsg processing, triggering a KMSAN uninitialized-value error and affecting system availability. Exploitation requires local access and high privileges; Red Hat assigns a CVSS 3.1 score of 4.4.
The upstream issue is fixed in Linux 6.1.76, 6.6.15, 6.7.3, 6.8, and later stable releases. Red Hat has issued fixes for affected Red Hat Enterprise Linux 8, RHEL 9, and RHEL 9.4 Extended Update Support packages, while RHEL 8 and RHEL 9 real-time kernels remain affected; unsupported RHEL 6 and 7 variants should be considered potentially affected. Organizations should update to vendor-supported current kernel releases rather than cherry-picking the individual upstream patch.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000, providing a fixed RHEL 8 kernel package for CVE-2024-26638.
Red Hat released RHSA-2025:9584, providing a fixed RHEL 9.4 Extended Update Support kernel package for CVE-2024-26638.
Red Hat released RHSA-2024:9315, providing a fixed RHEL 9 kernel package for CVE-2024-26638.
The Linux kernel CVE team documented fixes for the NBD flaw in Linux 6.1.76, 6.6.15, 6.7.3, and 6.8, which completely initialize struct msghdr. The team advised users to update to a current stable kernel release rather than cherry-pick individual commits.
A commit in Linux kernel 5.19 introduced incomplete initialization of struct msghdr in the NBD driver, allowing msg_get_inq to remain uninitialized during NBD reply reception.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
**CVE-2021-47101** affects the Linux kernel's ASIX USB networking driver in `drivers/net/usb/asix_common.c`. A short response from `asix_read_cmd()` in `asix_mdio_read()` can leave the `smsr` buffer uninitialized before `asix_check_host_enable()` uses it, potentially exposing uninitialized memory data or causing availability impacts through local exploitation. The flaw was introduced in Linux 4.9 and is fixed upstream in kernel versions 5.15.12 and 5.16 and later. Red Hat rates the issue at CVSS 6.0, while NVD assigns 7.1. Fixes are available for standard and real-time kernels in Red Hat Enterprise Linux 8 and the standard kernel in RHEL 9, including RHEL 9.4 Extended Update Support; the RHEL 9 `kernel-rt` package remains affected. Organizations using ASIX USB network adapters should deploy the latest vendor-supported kernel updates rather than cherry-picking individual patches.
Aug 26, 2026
A **double-free vulnerability** in the Linux kernel's NVMe subsystem, tracked as `CVE-2024-41073`, can let a local attacker trigger **memory corruption** and cause a **denial of service**. The bug occurs when a discard request is retried and then fails before a new special payload is attached, leaving cleanup logic to free the same resource twice unless the `RQF_SPECIAL_PAYLOAD` flag is cleared. The flaw affects `drivers/nvme/host/core.c` and is classified as `CWE-1341`. The Linux kernel CVE team said the issue was fixed in stable releases **5.15.164**, **6.1.101**, **6.6.42**, **6.9.11**, and **6.10**, and advised users to update to the latest stable kernel rather than cherry-picking patches. Red Hat rated the issue **Moderate** for its products with a **CVSS v3 score of 5.5**, noting fixes for multiple **Red Hat Enterprise Linux 8 and 9** kernel packages through RHSA advisories, while **RHEL 6** was listed as not affected; Red Hat also highlighted that external databases assigned higher scores to the same CVE.
Aug 25, 2026