Loading story…
CVE-2021-47386 is a NULL-pointer dereference in the Linux kernel's w83791d hardware-monitoring driver. Device-provided values can trigger a read path that dereferences an obsolete lm75[] structure field, causing a kernel crash and resulting in a local denial of service. The field was no longer needed after the driver moved subclient detection to devm_i2c_new_dummy_device().
The issue was identified by the Linux Driver Verification project and fixed in kernel versions 5.4.151, 5.10.71, 5.14.10, and 5.15 and later. Red Hat rates the flaw Moderate (CVSS 4.4), requiring local high privileges with availability-only impact; fixes are available in affected RHEL 8 and RHEL 9 kernel packages, while RHEL 9 kernel-rt is marked will not fix and RHEL 6 and 7 are outside support scope.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed CVE-2021-47386 in the RHEL 8 kernel through RHSA-2024:7000 and in the RHEL 8 kernel-rt package through RHSA-2024:7001.
Red Hat fixed CVE-2021-47386 for the RHEL 9.4 Extended Update Support kernel through RHSA-2025:4509.
Red Hat fixed CVE-2021-47386 in the RHEL 9 kernel through RHSA-2024:9315.
The fix removes the unnecessary lm75[] field from the w83791d driver. It was incorporated into Linux kernel versions 5.4.151, 5.10.71, 5.14.10, and 5.15.
The Linux kernel CVE team assigned CVE-2021-47386 to the NULL pointer dereference in drivers/hwmon/w83791d.c, which could crash the kernel and cause denial of service.
The Linux Driver Verification project found that the w83791d hardware-monitoring driver could dereference a NULL pointer when processing specific device-provided values. The flaw was caused by an obsolete lm75[] structure field left after the driver changed its subclient handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47385** is a Linux kernel flaw in the `w83792d` hardware-monitoring driver. Under a specific device-read value pattern, the driver can dereference a NULL pointer through an obsolete `lm75[]` structure field, causing a kernel crash or system instability and creating a local denial-of-service condition. The issue was fixed by removing the unnecessary field from `drivers/hwmon/w83792d.c` and is addressed in kernel versions 5.4.151, 5.10.71, 5.14.10, and 5.15 or later stable releases. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access is required, while NVD assigned CVSS 5.5; affected organizations should update kernel packages, including supported RHEL 8 and 9 streams, as no practical mitigation is available.
Aug 26, 2026
**CVE-2024-26717** is a local denial-of-service flaw in the Linux kernel's Open Firmware (OF) I2C HID driver at `drivers/hid/i2c-hid/i2c-hid-of.c`. Introduced in kernel 5.12 when I2C HID support was split into ACPI and OF implementations, the OF driver can leave a client pointer uninitialized; a failed device power-up can then trigger a NULL-pointer dereference and crash or restart the kernel. The issue is fixed in upstream kernels 5.15.149, 6.1.79, 6.6.18, 6.7.6, and 6.8 and later. Red Hat rated the flaw CVSS 4.4 (low) and released corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support systems; its referenced advisory listed RHEL 9 `kernel-rt` as affected without a corresponding erratum. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2024-41093** is a null-pointer dereference in the Linux kernel's AMDGPU DRM virtual KMS code. A local low-privileged user could trigger a kernel crash and denial of service because the driver accessed `state->fb->obj[0]` without confirming that the framebuffer object existed. The issue is rated Moderate by Red Hat, with a CVSS v3.1 score of 5.5 and high availability impact. The upstream fix replaces the direct object access with `drm_gem_fb_get_obj()` and returns an error when no framebuffer object is present. Corrected upstream kernels include 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10; Red Hat has released updated RHEL 8 and RHEL 9 `kernel` and `kernel-rt` packages, while RHEL 6 and 7 are not affected. Organizations using AMDGPU should deploy the relevant kernel updates and reboot affected hosts.
Aug 26, 2026