Loading story…
CVE-2023-52622 is an ext4 filesystem vulnerability that can prevent online resizing of filesystems created with an oversized flexible block-group (flex_bg) configuration. During resizing, ext4 may attempt to allocate a new_group_data array larger than the kernel allocator's MAX_ORDER limit, triggering a WARN_ON condition and causing the resize operation to fail. Red Hat rates the issue CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): a local low-privileged user can cause a high availability impact without user interaction.
Upstream Linux fixed the issue by limiting each resize pass to MAX_RESIZE_BG—16,384 block groups—and completing larger expansions over multiple iterations, potentially dispersing metadata within a flex_bg. Fixes are available in stable kernels 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat released fixes for affected RHEL 8 and RHEL 9 kernel packages through errata issued from August 2024 to May 2025; RHEL 9 kernel-rt remains affected, while RHEL 6 and 7 are outside support scope.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, addressing CVE-2023-52622.
Red Hat released RHSA-2025:8248 to address CVE-2023-52622 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315, fixing CVE-2023-52622 in the Red Hat Enterprise Linux 9 kernel.
Stable kernel releases 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8 incorporated a fix that caps each ext4 resize iteration at 16,384 groups and handles larger expansions in multiple iterations.
The Linux kernel CVE team assigned CVE-2023-52622 for an ext4 issue where an oversized flex_bg configuration can make an online resize allocate beyond the kernel allocator's MAX_ORDER limit, causing a warning and resize failure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
**CVE-2021-47383** is a moderate-severity out-of-bounds read flaw in the Linux kernel framebuffer-console (`tty`) subsystem's `imageblit` function. A local low-privileged process can trigger invalid `vmalloc` memory access through an `FBIOPUT_VSCREENINFO` ioctl request containing only partially populated `fb_var_screeninfo` fields, including `xres`, `yres`, and `bits_per_pixel`. If the requested configuration matches the prior request, the kernel can skip `resize_screen()`, leaving display values incomplete and producing incorrect row and coordinate calculations that lead to the invalid access, system crashes, or instability. The upstream fix forces `resize_screen()` to populate the structure even where no display resize is needed; corrected releases span kernel versions from 4.4.286 through 5.15. Red Hat rated the issue CVSS 6.6 (`CWE-125`) and issued fixes for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support kernel packages. Organizations should deploy updated kernel packages; no practical workaround was identified. RHEL 9 `kernel-rt` remained affected in the advisory, while RHEL 7 packages were outside support scope.
Aug 26, 2026
Red Hat addressed **CVE-2024-35890**, a medium-severity Linux kernel flaw in Generic Receive Offload (GRO) caused by incorrect socket-reference ownership transfer while processing packets with fragment lists. A local, low-privileged attacker could trigger kernel bugs or system instability, producing a high availability impact; Red Hat assigned the issue a CVSS v3.1 score of 5.5. Upstream fixes are included in kernel versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9. Red Hat released patched kernel packages across affected RHEL 8 and RHEL 9 streams, including **RHSA-2025:0062** for RHEL 8.8 Extended Update Support and associated service variants. That advisory provides `kernel-4.18.0-477.86.1.el8_8` packages for x86_64, s390x, ppc64le, and aarch64 and also remediates CVE-2024-53122. Administrators should install the applicable kernel updates and reboot systems; RHEL 6 is outside support scope and should be treated as affected.
Aug 26, 2026