Loading story…
A NULL-pointer dereference in the Linux kernel Digital Phase Locked Loop (DPLL) subsystem, tracked as CVE-2023-6679, allows a local authenticated attacker to crash or restart an affected system. The flaw occurs in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c when a DPLL pin-set netlink operation omits the optional DPLL_A_PIN_STATE attribute, which the vulnerable code reads unconditionally. Red Hat rated the issue CVSS 5.5 (Medium), citing low attack complexity, low privileges required, and high availability impact.
A kernel patch submitted by Jiri Pirko adds a presence check for DPLL_A_PIN_STATE before its value is used and credits Xingyuan Mo for reporting the issue. Red Hat released fixes for Red Hat Enterprise Linux 9 and RHEL 9.2 Extended Update Support; RHEL 9 kernel-rt remained affected in the vendor record, while listed RHEL 6, 7, and 8 variants were unaffected. No vendor-approved mitigation was available beyond applying the relevant kernel updates.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued kernel fixes for CVE-2023-6679 in RHEL 9, RHEL 9.2 Extended Update Support, and RHEL 9.2 EUS kernel-rt through RHSA-2024:0461, RHSA-2024:0448, and RHSA-2024:0439. The flaw is a local denial-of-service vulnerability caused by a NULL pointer dereference in the Linux kernel DPLL subsystem.
Jiri Pirko submitted a patch to prevent a NULL pointer dereference in dpll_pin_parent_pin_set() when a DPLL pin-set message omits the optional DPLL_A_PIN_STATE attribute. The issue was reported by Xingyuan Mo.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47560** is a NULL-pointer dereference in the Linux kernel's Mellanox `mlxsw` Spectrum driver. Buggy firmware can send port up/down events for the CPU port (local port 0), which has no associated network-device structure; processing those events can crash the kernel and cause a denial of service. The flaw was introduced in Linux 5.4 and is mitigated by ignoring events for the CPU port. Upstream fixes are included in Linux kernel versions 5.10.83, 5.15.6, and 5.16 and later. Red Hat rated the issue moderate severity (CVSS 4.4), noting local high-privilege access requirements, while NVD assigned a 5.5 score; patched kernel and `kernel-rt` packages are available for affected RHEL 8 and 9 systems, whereas RHEL 6 is unaffected and RHEL 7 is out of support scope.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026
**CVE-2022-41858** is a null-pointer dereference in the Linux SLIP network driver (`drivers/net/slip`) that can crash the kernel. A race condition can leave `sl_tx_timeout()` dereferencing the SLIP device's `sl->tty` pointer after `slip_close()` clears it during device detachment; an attacker able to emulate a SLIP network interface from user space could trigger a denial of service. Red Hat shipped fixes across RHEL kernel update streams, including RHSA-2024:1367 for selected RHEL 8.4 channels, which requires kernel version `4.18.0-305.125.1.el8_4` or later and a reboot. Related March kernel advisories also delivered fixes for other networking and kernel flaws: RHSA-2024:1377 provides an updated RHEL 8.4 `kpatch-patch` live-patching module, while RHSA-2024:1332 updates RHEL 7 Real Time `kernel-rt` packages and requires a reboot.
Aug 26, 2026