Loading story…
CVE-2021-30002 is a moderate-severity Linux kernel flaw in the Video4Linux (V4L2) video_usercopy ioctl helper. A local unauthenticated attacker with access to a webcam/video device can supply large ioctl arguments, causing unreleased memory allocations and potentially exhausting system memory to trigger a denial of service. The issue affects kernels before 5.11.3; Red Hat rates it CVSS 3.1 6.2 and maps it to CWE-772, with no reported confidentiality or integrity impact.
Upstream corrected the allocation and cleanup logic in commit fb18802a338b36f675a388fc03d2aa504a0d0899, separating array-argument storage from the general ioctl buffer and freeing it with kvfree(). Red Hat issued fixes for affected RHEL 8 kernel and kernel-rt packages through RHSA-2022:7444 and RHSA-2022:7683, followed by RHEL 8.6 EUS and Red Hat Virtualization updates; RHEL 7 remains marked will-not-fix. Organizations unable to patch can mitigate exposure by preventing the v4l2-common kernel module from loading.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat addressed CVE-2021-30002 for RHEL 8 kernel-rt through RHSA-2022:7444 and for the RHEL 8 kernel through RHSA-2022:7683.
Guilherme de Almeida Suckevicz reported the V4L2 video_usercopy memory-leak issue, which can be triggered with large arguments when a webcam device is present.
RHSA-2024:0724 fixed CVE-2021-30002 in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8 kernel packages.
Red Hat closed its tracking bug for CVE-2021-30002 after issuing fixes for affected RHEL 8 packages.
An upstream Linux kernel patch introduced separate allocation and cleanup of array ioctl buffers in the V4L2 video_usercopy helper, including independently freeing array_buf with kvfree.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-45887** is a memory-leak flaw in the Linux kernel's TTUSB-DEC USB media driver, caused by `ttusb_dec_exit_dvb()` unregistering a DVB frontend without calling `dvb_frontend_detach()`. A local low-privileged user who can repeatedly connect and disconnect an affected device could exhaust kernel memory and cause a denial of service. The issue affects kernel versions through 6.0.9 and is classified as CWE-401; Red Hat rates it Moderate with a CVSS v3.1 score of 4.7. Upstream corrected the cleanup path in commit `517a28133832` by using `dvb_frontend_detach(dec->fe)`, allowing the frontend to be freed properly; Fedora received the fix in stable kernel 6.3.7. Red Hat issued fixes for affected RHEL 8 kernel variants, including 8.6 and 8.8 Extended Update Support, and relevant Red Hat Virtualization 4 deployments; RHEL 9 is unaffected. Organizations unable to patch can reduce exposure by blacklisting the `ttusb_dec` kernel module.
Aug 26, 2026
**CVE-2022-41218** is a medium-severity use-after-free flaw in the Linux kernel's `dvb-core` subsystem, affecting Digital Video Broadcasting devices. A local low-privileged attacker could race malicious code against removal of a USB DVB demultiplexer or similar device, causing freed memory in `drivers/media/dvb-core/dmxdev.c` to be accessed. Successful exploitation could crash the host or potentially elevate privileges, although Red Hat rated the issue CVSS 5.5 because physical device removal and a difficult-to-win race condition are required. Kernel developers identified related DVB frontend, network, and device-registration races involving concurrent open, close, and USB-disconnect operations; KASAN reproduced the use-after-free conditions on Linux 6.1.0-rc2 and later. Fedora shipped a fix in kernel 6.0.18 stable updates, while Red Hat remediated affected RHEL 8 `kernel` and `kernel-rt` packages through RHSA-2023:2736 and RHSA-2023:2951, with subsequent coverage for RHEL 8.6 EUS and Red Hat Virtualization 4. Organizations unable to patch can mitigate exposure by preventing the `dvb-core` module from loading; RHEL 9 `kernel-rt` was marked will not fix.
Aug 26, 2026
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026