Loading story…
CVE-2023-52653 is a Linux kernel memory-leak flaw in the SUNRPC GSS/Kerberos context-import path. When gss_import_v2_context fails, memory allocated through kmemdup for ctx->mech_used.data is not released before gss_krb5_import_sec_context frees the context. The defect, present since kernel 2.6.35 in net/sunrpc/auth_gss/gss_krb5_mech.c, can cause an availability impact for local, low-privileged users; Red Hat rates it CVSS 3.1 5.5.
The upstream fix is included in stable Linux kernels 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1, and administrators should deploy a current stable kernel. Red Hat released fixes for RHEL 8 kernel and kernel-rt packages in August 2024 and for the RHEL 9.4 Extended Update Support kernel in April 2025; RHEL 9 remains affected, with its kernel-rt update deferred.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the Red Hat Enterprise Linux 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, fixing CVE-2023-52653 in both packages.
Red Hat published its CVE-2023-52653 record, documenting a low-severity Linux kernel SUNRPC memory leak. Red Hat assigned a CVSS v3.1 score of 5.5, with local low-privilege access required and availability as the only impacted security property.
Red Hat released RHSA-2025:3510, fixing CVE-2023-52653 for the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
The issue was fixed in Linux kernel versions 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1. The remediation replaces the final gss_import_v2_context call with gss_krb5_import_ctx_v2 to ensure the allocated memory is freed while preserving return behavior.
The SUNRPC GSS/Kerberos context-import memory leak was introduced in Linux kernel 2.6.35 by commit 47d848077629. On an error path, the context cleanup did not free memory allocated for ctx->mech_used.data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52623** is a Linux kernel SUNRPC flaw in `net/sunrpc/xprtmultipath.c` that permits traversal of an RCU-protected list without an RCU read-side lock. The issue was observed during `cthon` testing against an ONTAP server using pNFS, where it generated an RCU warning. A low-privileged local user can exploit the condition without user interaction, with availability as the rated impact; Red Hat assigns a CVSS v3.1 score of 5.5 and classifies it as CWE-362. The upstream fix changes `rpc_xprt_switch_has_addr()` to always acquire `rcu_read_lock()`, including when invoked by callers that already hold the lock. Corrected stable kernels include 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat has released fixes for affected RHEL 8 `kernel` and `kernel-rt` packages and RHEL 9.4 Extended Update Support; RHEL 9 remains affected, while its `kernel-rt` fix is deferred. Organizations should deploy current vendor-supported kernel updates rather than cherry-picking the upstream patch.
Aug 26, 2026
Red Hat issued Important kernel security updates for **RHEL 9** and **RHEL 10** that remediate **CVE-2025-38089**, a flaw in Linux SunRPC server authentication handling. A crafted RPC request can produce an `SVC_GARBAGE` result without initializing an acceptance-status pointer, potentially crashing a kernel thread on its first RPC request or causing memory corruption. The upstream correction maps the condition to `AUTH_ERROR` with `AUTH_BADCRED`, in line with RFC 5531. RHSA-2025:11411 delivers the SunRPC fix for RHEL 9 across x86_64, ARM64, s390x, and ppc64le channels, alongside a uvcvideo dangling-pointer fix for CVE-2024-58002. RHSA-2025:11428 updates RHEL 10 kernels and addresses five vulnerabilities affecting uvcvideo, iwlwifi, huge_memory, and SunRPC components. Red Hat also fixed **CVE-2022-49995**, a writeback use-after-free that can occur after disk-device removal, in RHEL 9 SAP Update Services packages. Organizations should install the applicable kernel updates and reboot systems to activate the fixes.
Aug 26, 2026
**CVE-2024-58088** is a Linux kernel BPF flaw that lets a sufficiently privileged local attacker cause a system deadlock while cgroup local storage is being freed. Introduced in kernel 6.2, the affected `BPF_MAP_TYPE_CGRP_STORAGE` cleanup path passed a null busy counter to `bpf_local_storage_map_free()`, enabling a BPF program invoked during cleanup to recursively access storage and attempt to reacquire an already held local-storage lock. Repeated creation and destruction of crafted BPF programs can leave a worker thread deadlocked, causing an availability impact. The issue is fixed upstream in Linux 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4 and later; administrators should deploy a current stable kernel rather than cherry-pick the patch. Red Hat rates the issue Moderate (CVSS 4.4) and has issued fixes for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 9 `kernel-rt` is affected, while RHEL 6, 7, 8 and their listed real-time kernel variants lack the vulnerable code.
Aug 26, 2026