Loading story…
CVE-2023-52658 is a moderate-severity local denial-of-service flaw in the Linux kernel's Mellanox mlx5 switchdev offload driver. A change intended to block switchdev mode when network namespace state is inconsistent can instead trigger a system crash. The vulnerable change was introduced in Linux 6.3 and backported to Linux 6.1.22 and 6.2.9; fixes revert the change and are included in Linux 6.6.22, 6.7.10, and 6.8.
Red Hat rates the issue CVSS 5.5: exploitation requires low privileges and affects availability, with no identified confidentiality or integrity impact. Red Hat shipped fixes in RHEL 8 kernel and kernel-rt updates and the RHEL 9 kernel update, while RHEL 9 kernel-rt remained listed as affected; organizations using MLX5 adapters in switchdev mode should deploy current vendor kernel updates rather than individually cherry-picking patches.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, fixing CVE-2023-52658 by incorporating the reversion.
Red Hat released RHSA-2024:8162 for the RHEL 9 kernel to address CVE-2023-52658. RHEL 9 kernel-rt remained listed as affected without an identified erratum.
The issue tracked as CVE-2023-52658 was resolved by reverting the crash-causing change. Fixes were included in Linux 6.6.22, 6.7.10, and 6.8.
A change in Linux 6.3, later backported to Linux 6.1.22 and 6.2.9, could cause system crashes in the Mellanox mlx5 switchdev offload implementation, creating a local denial-of-service condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47560** is a NULL-pointer dereference in the Linux kernel's Mellanox `mlxsw` Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port. Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and `kernel-rt` packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
Aug 26, 2026
**CVE-2024-26880** is a moderate-severity Linux kernel flaw in the device-mapper subsystem, specifically `drivers/md/dm.c`, that can corrupt an internal list and trigger a kernel BUG or system crash in the `dm_snapshot` path. During an internal suspend, device-mapper failed to invoke the target resume handler correctly; the resulting mismatch can call `origin_postsuspend` twice and attempt to remove a list entry that was already removed. The issue was introduced in Linux kernel 3.19 and has a CVSS v3.1 score of 4.4, requiring local access and high privileges but posing a high availability impact. The vulnerability is fixed in stable kernel versions 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and later releases. Red Hat has issued corrected kernel packages for affected RHEL 8, RHEL 9, and RHEL 9.2 Extended Update Support deployments; RHEL 9 `kernel-rt` was still listed as affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should apply the applicable vendor kernel update and reboot affected hosts.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026