Loading story…
CVE-2021-47468 affects the Linux kernel's mISDN NetJet ISDN driver, where card->isac.release() can be invoked while a lock is held in an atomic context. Because the release path may sleep, a local attacker able to exercise the affected device-removal path could trigger a kernel fault or denial of service. The upstream fix defers the release-function call until after the lock has been released.
The fix was backported to stable kernels including 4.4.290, 4.9.288, 4.14.253, 4.19.214, 5.4.156, 5.10.76, 5.14.15, and 5.15. Red Hat rated the flaw Low severity (CVSS 4.4) and released RHEL 8 kernel updates through advisories including RHSA-2024:5101 and RHSA-2024:5102; RHEL 9 is not affected. Organizations should deploy their vendor's current kernel updates rather than cherry-picking the upstream patch.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:5101 and RHSA-2024:5102 to address CVE-2021-47468 in Red Hat Enterprise Linux 8 kernel and kernel-rt streams.
Red Hat issued RHSA-2024:6993 to fix CVE-2021-47468 for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat issued RHSA-2024:5692 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions, addressing CVE-2021-47468.
The Linux kernel CVE team assigned CVE-2021-47468 to a flaw in the mISDN NetJet ISDN driver where card->isac.release() could invoke sleeping work while an atomic-context lock was held. Upstream remediation moved the release-function call until after the relevant lock was released.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47284** affects the Linux kernel's mISDN Netjet ISDN driver (`drivers/isdn/hardware/mISDN/netjet.c`). When `nj_setup` fails with `-EIO` after the driver initializes `card->irq`, its cleanup routine can call `free_irq` for an interrupt that was never requested. This produces a kernel warning and can crash the system when `panic_on_warn` is enabled, creating a locally exploitable availability risk for systems using the affected hardware. The fix removes the premature IRQ assignment and preserves assignment immediately before `request_irq`. Fixed Linux stable releases include 4.4.273, 4.9.273, 4.14.237, 4.19.195, 5.4.126, 5.10.44, 5.12.11, and 5.13; organizations should deploy a current stable kernel. Red Hat rated the issue **Low** severity (CVSS 3.1: 5.5) and issued fixes for RHEL 8 `kernel` and `kernel-rt`; RHEL 9 is not affected, while RHEL 6 and 7 are out of support.
Aug 26, 2026
**CVE-2021-47560** is a NULL-pointer dereference in the Linux kernel's Mellanox `mlxsw` Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port. Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and `kernel-rt` packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026