Loading story…
A use-after-free vulnerability in the Linux kernel Consumer Electronics Control (CEC) subsystem, tracked as CVE-2024-23848, can occur in cec_queue_msg_fh through a race condition in the CEC ioctl path. Kernel fuzzing showed one thread could continue accessing a struct cec_fh message queue after another thread freed the object, producing a reproducible KASAN slab-use-after-free crash. Related testing also exposed a task hang, warnings, and a general-protection fault, with several issues suspected to share a locking-related cause.
Red Hat rated CVE-2024-23848 as moderate severity with a CVSS 3.1 score of 6.7, citing potential confidentiality, integrity, and availability effects; NVD and CVE.org assigned 5.5, primarily for availability impact. Fixes were released for standard and real-time kernels in RHEL 8 and for the standard RHEL 9 kernel, including RHEL 9.4 Extended Update Support. RHEL 6, RHEL 7, and RHEL 7 kernel-rt are unaffected, while the RHEL 9 real-time kernel is listed as will not fix.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed the CVE-2024-23848 use-after-free vulnerability in the RHEL 8 standard kernel through RHSA-2024:7000 and in the RHEL 8 real-time kernel through RHSA-2024:7001.
Red Hat released RHSA-2025:3510 to fix CVE-2024-23848 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315 to fix CVE-2024-23848 in the Red Hat Enterprise Linux 9 kernel.
Linux media maintainer Hans Verkuil said he had identified two issues, was investigating a third, and intended to submit patches for retesting. He assessed that several of the reported CEC crashes could share a locking-related root cause.
Researchers Chenyuan Yang, Zijie Zhao, and colleagues reported five crashes found by fuzzing the Linux kernel CEC device ioctl path, including a reproducible KASAN slab-use-after-free in cec_queue_msg_fh. They supplied a Syzkaller reproducer showing a race in which a struct cec_fh can be used after it is freed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026
**CVE-2024-56675** is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its `perf_event`; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. Red Hat rated the issue **Moderate** (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring `CAP_SYS_ADMIN` or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
Aug 26, 2026