Loading story…
CVE-2023-52623 is a Linux kernel SUNRPC flaw in net/sunrpc/xprtmultipath.c that permits traversal of an RCU-protected list without an RCU read-side lock. The issue was observed during cthon testing against an ONTAP server using pNFS, where it generated an RCU warning. A low-privileged local user can exploit the condition without user interaction, with availability as the rated impact; Red Hat assigns a CVSS v3.1 score of 5.5 and classifies it as CWE-362.
The upstream fix changes rpc_xprt_switch_has_addr() to always acquire rcu_read_lock(), including when invoked by callers that already hold the lock. Corrected stable kernels include 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat has released fixes for affected RHEL 8 kernel and kernel-rt packages and RHEL 9.4 Extended Update Support; RHEL 9 remains affected, while its kernel-rt fix is deferred. Organizations should deploy current vendor-supported kernel updates rather than cherry-picking the upstream patch.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 real-time kernel, fixing CVE-2023-52623.
Red Hat published its CVE record for the Linux kernel SUNRPC race-condition vulnerability, rating it Low severity with a CVSS v3.1 score of 5.5 and potential availability impact from local exploitation.
Red Hat released RHSA-2025:9584 to fix CVE-2023-52623 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
The Linux kernel CVE team identified CVE-2023-52623 as an unsafe RCU-protected list traversal in net/sunrpc/xprtmultipath.c. The remediation makes rpc_xprt_switch_has_addr() acquire rcu_read_lock() unconditionally, and fixes were made available in stable kernel versions from 4.19.307 through 6.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52653** is a Linux kernel memory-leak flaw in the SUNRPC GSS/Kerberos context-import path. When `gss_import_v2_context` fails, memory allocated through `kmemdup` for `ctx->mech_used.data` is not released before `gss_krb5_import_sec_context` frees the context. The defect, present since kernel 2.6.35 in `net/sunrpc/auth_gss/gss_krb5_mech.c`, can cause an availability impact for local, low-privileged users; Red Hat rates it CVSS 3.1 5.5. The upstream fix is included in stable Linux kernels 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1, and administrators should deploy a current stable kernel. Red Hat released fixes for RHEL 8 `kernel` and `kernel-rt` packages in August 2024 and for the RHEL 9.4 Extended Update Support kernel in April 2025; RHEL 9 remains affected, with its `kernel-rt` update deferred.
Aug 26, 2026
A flaw tracked as **CVE-2026-43158** in the Linux kernel's **XFS** filesystem can let a local user trigger a denial of service by causing an assertion failure and filesystem shutdown. The bug affects XFS attribute leaf block handling during repeated `setxattr` operations: crafted extended attribute insertions can corrupt freemap accounting so that the entries array overlaps free space. The issue is classified as **CWE-617 Reachable Assertion**, carries a **CVSS v3 score of 7.0** from Red Hat, and traces back to code introduced in Linux `2.6.12`. The Linux kernel community published fixes across multiple stable branches, with maintainers advising organizations to update to current stable kernels rather than cherry-pick patches. Red Hat said no acceptable mitigation is available and shipped fixes through updated **RHEL** kernel packages and errata, including advisory **RHSA-2026:27735** for **RHEL 9.4 Update Services for SAP Solutions** and related variants. That advisory bundles **CVE-2026-43158** with other kernel vulnerabilities in components including **libceph**, **netfilter**, **SMB/CIFS**, **SCTP**, and **mac80211**, and requires affected systems to be rebooted after installation.
Aug 25, 2026
Red Hat issued Important kernel security updates for **RHEL 9** and **RHEL 10** that remediate **CVE-2025-38089**, a flaw in Linux SunRPC server authentication handling. A crafted RPC request can produce an `SVC_GARBAGE` result without initializing an acceptance-status pointer, potentially crashing a kernel thread on its first RPC request or causing memory corruption. The upstream correction maps the condition to `AUTH_ERROR` with `AUTH_BADCRED`, in line with RFC 5531. RHSA-2025:11411 delivers the SunRPC fix for RHEL 9 across x86_64, ARM64, s390x, and ppc64le channels, alongside a uvcvideo dangling-pointer fix for CVE-2024-58002. RHSA-2025:11428 updates RHEL 10 kernels and addresses five vulnerabilities affecting uvcvideo, iwlwifi, huge_memory, and SunRPC components. Red Hat also fixed **CVE-2022-49995**, a writeback use-after-free that can occur after disk-device removal, in RHEL 9 SAP Update Services packages. Organizations should install the applicable kernel updates and reboot systems to activate the fixes.
Aug 26, 2026