Loading story…
CVE-2021-47497 affects the Linux kernel NVMEM subsystem's cell-read masking logic when a cell's nbits value is an exact multiple of BITS_PER_BYTE. A modulo-zero calculation can be decremented before use, producing an invalid shift exponent—reported by UBSAN as a 64-bit shift on a 64-bit system—and causing undefined behavior. The flaw was introduced in Linux 4.3 and is primarily associated with availability impact under Red Hat's assessment.
Upstream fixed the issue in stable kernel releases including 4.4.290, 4.9.288, 4.14.252, 4.19.213, 5.4.155, 5.10.75, 5.14.14, and 5.15; the kernel CVE team advises upgrading to a current stable release rather than cherry-picking patches. Red Hat rated the issue Low (CVSS 3.1: 4.4), issued fixes for RHEL 8 standard and real-time kernels and the RHEL 9 standard kernel, and lists the RHEL 9 kernel-rt package as affected without a corresponding erratum.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 real-time kernel, addressing CVE-2021-47497.
Red Hat released RHSA-2025:2490, fixing CVE-2021-47497 for the RHEL 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315 to address CVE-2021-47497 in the standard RHEL 9 kernel.
Fixes for CVE-2021-47497 were included in stable kernel releases 4.4.290, 4.9.288, 4.14.252, 4.19.213, 5.4.155, 5.10.75, 5.14.14, and 5.15. The Linux kernel CVE team recommended upgrading to a current stable release rather than cherry-picking individual commits.
The Linux kernel CVE team assigned CVE-2021-47497 to the NVMEM out-of-bounds shift issue in drivers/nvmem/core.c. The fix checks that bits remain to be masked before applying the mask operation.
The vulnerable NVMEM cell-read masking logic was introduced by commit 69aba7948cbe in Linux kernel 4.3. When a cell bit count is an exact multiple of BITS_PER_BYTE, the calculation can produce an invalid shift parameter and trigger undefined behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CVE-2024-26638 is a low-severity flaw in the Linux kernel's Network Block Device (NBD) driver, introduced in kernel version 5.19. Incomplete initialization of a `struct msghdr` in the NBD reply-receive path can expose the uninitialized `msg_get_inq` field during `tcp_recvmsg` processing, triggering a KMSAN uninitialized-value error and affecting system availability. Exploitation requires local access and high privileges; Red Hat assigns a CVSS 3.1 score of 4.4. The upstream issue is fixed in Linux 6.1.76, 6.6.15, 6.7.3, 6.8, and later stable releases. Red Hat has issued fixes for affected Red Hat Enterprise Linux 8, RHEL 9, and RHEL 9.4 Extended Update Support packages, while RHEL 8 and RHEL 9 real-time kernels remain affected; unsupported RHEL 6 and 7 variants should be considered potentially affected. Organizations should update to vendor-supported current kernel releases rather than cherry-picking the individual upstream patch.
Aug 26, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
**CVE-2021-47383** is a moderate-severity out-of-bounds read flaw in the Linux kernel framebuffer-console (`tty`) subsystem's `imageblit` function. A local low-privileged process can trigger invalid `vmalloc` memory access through an `FBIOPUT_VSCREENINFO` ioctl request containing only partially populated `fb_var_screeninfo` fields, including `xres`, `yres`, and `bits_per_pixel`. If the requested configuration matches the prior request, the kernel can skip `resize_screen()`, leaving display values incomplete and producing incorrect row and coordinate calculations that lead to the invalid access, system crashes, or instability. The upstream fix forces `resize_screen()` to populate the structure even where no display resize is needed; corrected releases span kernel versions from 4.4.286 through 5.15. Red Hat rated the issue CVSS 6.6 (`CWE-125`) and issued fixes for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support kernel packages. Organizations should deploy updated kernel packages; no practical workaround was identified. RHEL 9 `kernel-rt` remained affected in the advisory, while RHEL 7 packages were outside support scope.
Aug 26, 2026