Loading story…
CVE-2021-47461 is a race condition in the Linux kernel's userfaultfd subsystem, triggered when userfaultfd_writeprotect() runs concurrently with exit_mmap() as a process exits and its virtual-memory areas are removed. Introduced in kernel 5.7, the flaw was detected with KASAN and can affect confidentiality, integrity, and availability; Red Hat rated it CVSS 7.0, while NVD assigned 4.7 primarily for availability impact.
The upstream issue is fixed in Linux stable releases 5.10.76, 5.14.15, and 5.15 and later. Red Hat released corrected RHEL 8 kernel and kernel-rt packages through errata issued between August and November 2024; RHEL 9 is not affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should deploy a current vendor-supported kernel release rather than cherry-picking the individual patch.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for RHEL 8 kernel packages and RHSA-2024:5102 for RHEL 8 kernel-rt packages, addressing CVE-2021-47461.
Red Hat issued RHSA-2024:10262 to address CVE-2021-47461 in RHEL 8.8 Extended Update Support kernel packages.
RHSA-2024:6297 addressed CVE-2021-47461 kernel packages for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
The Linux kernel CVE team assigned CVE-2021-47461 to the userfaultfd race condition, which can occur when a process exits while virtual memory areas are removed concurrently with a write-protect request.
A race between userfaultfd_writeprotect() and exit_mmap() in fs/userfaultfd.c was introduced in Linux kernel 5.7. Upstream fixes using mmget_not_zero() were included in stable kernel versions 5.10.76, 5.14.15, and 5.15.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
Red Hat released fixes for **CVE-2023-28466**, a moderate-severity race condition in the Linux kernel TLS subsystem's `do_tls_getsockopt` function. The flaw can trigger a use-after-free condition or NULL-pointer dereference; a local attacker with low privileges could affect system confidentiality, integrity, and availability. Red Hat rates the vulnerability **CVSS 7.0**. The remediation includes RHEL 8 kernel packages under **RHSA-2023:3847**, including `kernel-4.18.0-477.15.1.el8_8` for supported x86_64, s390x, ppc64le, and aarch64 variants, with fixes also available for affected RHEL 9 kernels. Organizations should install the applicable updates and reboot systems; where patching cannot occur immediately, Red Hat recommends preventing the TLS kernel module from loading at boot.
Aug 26, 2026
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026