Loading story…
CVE-2023-52730 affects the Linux kernel MMC/SDIO subsystem, where failures in sdio_add_func() or sdio_init_func() could leave device-tree node and device references unreleased. Because an SDIO function was not marked present during those error paths, cleanup could skip of_node_put() and put_device(), causing memory and resource leaks observable through fault-injection testing. The flaw has local availability implications and was introduced in kernel 2.6.33.
Upstream corrected the cleanup flow by ensuring device-tree and device references are always released while retaining conditional device deletion, and by relocating reference acquisition and release to balance get_device() and put_device() operations. Fixes are available in stable kernels 4.14.306, 4.19.273, 5.4.232, 5.10.169, 5.15.95, 6.1.13, and 6.2, and Red Hat issued updates for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 EUS; RHEL 9 kernel-rt was listed as affected.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, addressing CVE-2023-52730.
Red Hat published its record for CVE-2023-52730, describing a low-severity Linux kernel MMC/SDIO resource-leak vulnerability. Red Hat assigned a CVSS v3.1 score of 4.4.
Red Hat released RHSA-2025:15016 to address CVE-2023-52730 in the RHEL 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315 to fix CVE-2023-52730 in the RHEL 9 kernel.
The resource-leak issue was fixed in Linux stable releases 4.14.306, 4.19.273, 5.4.232, 5.10.169, 5.15.95, 6.1.13, and 6.2. The changes ensure applicable of_node_put() and put_device() cleanup calls occur even when the SDIO function is not present.
The MMC/SDIO error-path flaw was introduced by commit 3d10a1ba0d37 in Linux kernel 2.6.33. Failed sdio_add_func() or sdio_init_func() operations could leave device-tree-node and device references unreleased.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
A race condition in the Linux kernel's `r592` MemoryStick host-controller driver can trigger a use-after-free during device or module removal. The `r592_remove` routine could free the host object while the detect timer was still able to queue work referencing it, enabling a local attacker with specialized peripheral hardware, high privileges, and precise timing to crash the system or potentially expose kernel information. The issue is tracked as **CVE-2023-35825** and **CVE-2023-3141**, with Red Hat assigning a CVSS v3.1 score of 6.4. The upstream fix stops and synchronizes the detect timer with `del_timer_sync(&dev->detect_timer)` before device cleanup, preventing active timer callbacks from accessing freed memory. Red Hat released corrected kernel packages for multiple RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4; RHEL 9 `kernel-rt` remained affected in the referenced advisories, while RHEL 6 and 7 packages were outside support scope. Organizations using affected systems should apply the applicable Red Hat kernel updates, particularly where r592 hardware is present or can be physically attached.
Aug 26, 2026
Red Hat addressed **CVE-2021-47287**, a Linux kernel driver-core flaw in `drivers/base/auxiliary.c` that leaks memory when `driver_register()` fails. In the affected `__auxiliary_driver_register()` path, memory allocated for `auxdrv->driver.name` was not released before the function returned, creating a local denial-of-service risk through resource exhaustion. Red Hat assigns the issue a CVSS 3.1 score of 5.5 (medium), with low-privilege local access required and availability as the affected security property. The defect was introduced in Linux kernel 5.11 and fixed upstream in versions 5.13.6 and 5.14. Red Hat released fixes for affected RHEL 8 `kernel` and `kernel-rt` packages through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as not affected. Organizations running affected RHEL 8 systems should apply the advisory updates and reboot into the updated kernel; upstream recommends using the latest stable kernel release rather than cherry-picking the patch.
Aug 26, 2026