Loading story…
CVE-2024-26908, initially assigned to missing kasprintf() allocation-failure checks in Linux arch/x86/xen/smp.c, was rejected upstream. The affected code could dereference a NULL pointer during virtual-CPU hotplug under out-of-memory conditions; fixes were nevertheless backported across stable kernel releases from 4.19.311 through 6.8.
Kernel maintainers determined the condition requires vCPU hotplug initiated by a host or guest administrator, rather than exposure to an unprivileged or remote attacker. Red Hat continues to catalog the issue as Moderate, with a 5.5 CVSS v3.1 denial-of-service assessment and RHEL 8 and 9 errata references, but organizations should treat the CVE as rejected rather than an active vulnerability while applying normal kernel maintenance updates.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:5101 with a kernel fix for Red Hat Enterprise Linux 8.
Red Hat issued RHSA-2024:4902 with a kernel fix for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2024:6993 with a kernel fix for RHEL 8.8 Extended Update Support.
Red Hat issued RHSA-2024:7002 with a kernel fix for RHEL 8.4 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2024:6992 with a kernel fix for RHEL 8.2 Advanced Update Support.
Red Hat issued RHSA-2024:5928 with a kernel fix for Red Hat Enterprise Linux 9.
Greg Kroah-Hartman confirmed that CVE-2024-26908 was rejected. The issue required administrative virtual-CPU hotplug during an out-of-memory condition and was not reachable by unprivileged or remote attackers.
The Linux kernel CVE team assigned CVE-2024-26908 to an x86/Xen smp.c issue where a failed kasprintf() allocation could be used without a NULL check. The upstream fix added validation after the allocation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-1852** is a moderate-severity NULL-pointer dereference in the Linux kernel's x86 KVM instruction-emulation path. A low-privileged attacker in an Intel-based virtual-machine guest can execute an illegal instruction and trigger a fault in `x86_emulate_insn`, causing a denial of service. Red Hat assigned a CVSS v3.1 score of 5.5 and classified the defect as CWE-476. The upstream Linux fix, commit `fee060cd52d69c114b62d1a2948ea9648b5131f9`, prevents KVM from invoking the x86 emulator before an instruction has been decoded, avoiding use of stale emulation context after breakpoint-related handling. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 systems and related products; RHEL 6 and 7 kernels are not affected. Where patching cannot be performed promptly, Red Hat recommends blacklisting the affected KVM kernel module at boot to prevent it from loading.
Aug 26, 2026
**CVE-2023-0597** affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive. The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
Aug 26, 2026
**CVE-2022-39189** affects the Linux kernel’s x86 KVM subsystem, where instruction emulation can leave the `KVM_VCPU_PREEMPTED` flag set and mishandle paravirtualized TLB flushes. Other guest vCPUs may then skip required TLB-flush IPIs while emulation accesses memory using stale guest-virtual translations, enabling an unprivileged user inside a VM to compromise the guest kernel or cause guest malfunction. The issue affects the `KVM_FEATURE_PV_TLB_FLUSH` functionality introduced in Linux 4.16 and was demonstrated through emulated VMMCALL and port-I/O operations. The upstream correction, commit `6cd88243c7e03845a450795e134b488fc2afb736`, was merged for Linux 5.19 and backported to the stable 5.15 and 5.18 kernel trees; affected kernels are generally versions before 5.18.17. Red Hat rated the vulnerability Moderate with CVSS 7.0 and issued fixes for affected RHEL 8, RHEL 8 kernel-rt, RHEL 8.6 EUS, RHEL 9, RHEL 9 kernel-rt, and Red Hat Virtualization 4 on RHEL 8 packages; Red Hat reported no qualifying mitigation, making deployment of the relevant kernel updates the required remediation.
Aug 26, 2026