Loading story…
CVE-2021-47527 affects the Linux kernel serial core (drivers/tty/serial/serial_core.c) because a UART transmit buffer was not freed and reset when a port was finally closed after conversion to tty_port_close(). A local low-privileged user could subsequently cause operations waiting for the buffer to drain to hang indefinitely, transmit stale buffered data after a port restart, or leak memory if an open serial-port driver is unbound. Red Hat rates the uncontrolled-resource-consumption issue as CVSS 5.5, with availability impact as the primary risk.
The flaw was introduced in Linux kernel 4.9 and fixed upstream in versions 4.9.292, 4.14.257, 4.19.220, 5.4.164, 5.10.84, 5.15.7, and 5.16. Red Hat shipped fixes for affected RHEL 8 kernel and kernel-rt packages in advisories RHSA-2024:7000 and RHSA-2024:7001, and later addressed RHEL 9.4 Extended Update Support; RHEL 9 kernel and kernel-rt packages remained listed as affected in the referenced Red Hat status.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt package, addressing CVE-2021-47527.
Red Hat released RHSA-2025:13135 to address CVE-2021-47527 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
The issue was fixed in stable Linux kernel versions 4.9.292, 4.14.257, 4.19.220, 5.4.164, 5.10.84, 5.15.7, and 5.16. The fix clears the transmit-buffer pointer while holding the port lock to address a line-discipline race.
The Linux kernel CVE team assigned CVE-2021-47527 to the serial-core transmit-buffer reset and memory-leak issue affecting drivers/tty/serial/serial_core.c.
A change converting uart_close() to use tty_port_close() in Linux kernel 4.9 failed to free the UART transmit buffer on final port close, creating the serial-core flaw later tracked as CVE-2021-47527.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-48760** is a Linux kernel USB-core synchronization flaw that can leave processes indefinitely blocked in `usb_kill_urb()` on SMP systems. Insufficient memory ordering between concurrent `usb_kill_urb()` and `__usb_hcd_giveback_urb()` operations can cause a USB request block completion wake-up to be missed; equivalent store-buffering patterns also affect `usb_poison_urb()` and the failure path of `usb_hcd_submit_urb()`. The upstream fix adds full memory barriers through `smp_mb__after_atomic()` and is available in kernel versions 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17 or later. Red Hat rated the issue Low severity (CVSS 4.1) and released RHEL 8 kernel and kernel-rt updates in **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 9 fixes remain deferred, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026
Red Hat released kernel updates for **RHEL 9** and **RHEL 10** addressing several locally exploitable Linux kernel flaws, including `CVE-2025-21647` in the `sch_cake` traffic-control scheduler. An underflow in per-host bulk-flow fairness counters could lead to an out-of-bounds read, potentially exposing kernel memory or crashing the system; Red Hat assigned it a CVSS 3.1 score of 7.1. The upstream correction adds centralized bounds checking for counter access. The updates also remediate denial-of-service issues in the mt76 `mt7925` Wi-Fi driver (`CVE-2024-57989`), HID core (`CVE-2024-57986`), IDPF driver (`CVE-2024-58057`), and Realtek Bluetooth setup path (`CVE-2024-57987`). These flaws can trigger NULL-pointer dereferences, CPU-workqueue starvation, or system crashes under local attack conditions. RHEL 9 `kernel-rt` remains affected or will not fix for several listed issues; organizations should apply the applicable kernel errata and reboot systems to activate the patched kernel.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026