Loading story…
CVE-2023-52679 is a double-free flaw in the Linux kernel Open Firmware (OF) routine of_parse_phandle_with_args_map() in drivers/of/base.c. Present since kernel 4.17, the bug can occur when an inner loop releases an OF-node reference while retaining a stale pointer value, potentially freeing the same object twice. Exploitation requires local access and low privileges, with no user interaction; NVD and CVE.org score it 7.8 CVSS v3.1, while Red Hat rates it Low at 5.5.
The flaw is fixed in stable kernels 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, and 6.8 and later. Red Hat has released fixes for RHEL 8 standard and real-time kernels and for RHEL 9 standard kernels, including RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt remains affected. RHEL 6 is unaffected, while unsupported RHEL 7 kernel and kernel-rt deployments should be treated as affected; administrators should upgrade to a current vendor-supported kernel release rather than cherry-pick the patch.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:1658 to address CVE-2023-52679 in the RHEL 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, addressing CVE-2023-52679.
Red Hat released RHSA-2024:9315 to fix CVE-2023-52679 in the standard RHEL 9 kernel.
The flaw was fixed in stable kernel releases 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, and 6.8. The fix resets new to NULL after assigning it to cur and extends unit tests for the vulnerable path.
The Linux kernel CVE team assigned CVE-2023-52679 to the Open Firmware double-free vulnerability, in which a stale value can cause of_node_put(new) to release an already released reference.
A commit in Linux kernel 4.17 introduced a stale-reference double-free condition in the Open Firmware function of_parse_phandle_with_args_map().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2022-36879**, a moderate-severity Linux kernel flaw in the XFRM packet-transformation framework. Faulty policy resolution in `xfrm_bundle_lookup`/`xfrm_expand_policies` can decrement a reference count twice, creating a memory-lifecycle error that a local, low-privileged attacker could use to crash the kernel and cause denial of service. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact. The defect affects upstream kernels through version 5.18.14; Fedora incorporated the correction in kernel 5.18.15, while upstream Linux includes it in version 5.19. Red Hat shipped fixes for supported RHEL 8 and RHEL 9 releases, including specified kernel-rt and Extended Update Support variants, as well as Red Hat Virtualization 4 for RHEL 8. Organizations should install the applicable supported kernel update and reboot where required; RHEL 6 and RHEL 7 are outside Red Hat's supported scope for this issue.
Aug 26, 2026
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026