Loading story…
CVE-2024-26939 is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in drivers/gpu/drm/i915/i915_vma.c. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked.
The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt, addressing CVE-2024-26939.
Red Hat released RHSA-2025:9584 for the RHEL 9.4 Extended Update Support kernel, addressing CVE-2024-26939.
Red Hat released RHSA-2024:9315 for the RHEL 9 kernel to fix CVE-2024-26939.
The issue was fixed in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2. The fix holds a GT wakeref through VMA activation and deactivation to prevent retirement code from using a freed VMA.
The Linux kernel CVE team assigned CVE-2024-26939 to a use-after-free race in the Intel i915 DRM driver's VMA destruction and retirement handling. The flaw was introduced by the Linux 5.19 commit d93939730347.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-22097** affects the Linux kernel's DRM Virtual Kernel Mode Setting (VKMS) driver (`drivers/gpu/drm/vkms/vkms_drv.c`). A failed driver initialization can cause `vkms_exit()` to access an uninitialized or already freed `default_config` pointer, creating a use-after-free or possible double-free condition. The flaw was introduced in Linux kernel 5.12. The issue is fixed in stable kernels 5.15.180, 6.1.134, 6.6.87, 6.12.23, 6.13.11, 6.14.2, and 6.15-rc1, and organizations should deploy a current stable kernel or applicable vendor errata. Red Hat rated the vulnerability moderate severity with CVSS 6.7, versus CVE.org's 7.8; Red Hat said an unprivileged local user cannot intentionally force VKMS initialization failure in its supplied configurations and released errata for multiple RHEL versions.
Aug 26, 2026
**CVE-2021-47338** is a use-after-free flaw in the Linux kernel framebuffer-memory (`fbmem`) subsystem. When `fb_delete_videomode()` deletes a video mode still in use, it fails to honor the result of `fbcon_mode_deleted()`, leaving later framebuffer ioctl handling able to access freed memory in `fb_mode_is_equal()`. The defect, introduced in kernel 5.3, can cause crashes or undefined behavior and was detected with KASAN. Red Hat rated the issue Moderate (CVSS 5.1 in its products), noting local access and high privileges are required, while NVD/cve.org assigned 7.8. Affected RHEL 8 `kernel` and `kernel-rt` packages were corrected through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as unaffected. Upstream fixes are available in kernels 5.4.134, 5.10.52, 5.12.19, 5.13.4, and 5.14, and administrators should deploy a current supported kernel because no practical mitigation is identified.
Aug 26, 2026
**CVE-2023-51043** is a use-after-free flaw in the Linux kernel DRM atomic modesetting subsystem. A local low-privileged attacker can race a nonblocking atomic display commit against unloading or removing a graphics driver, allowing the asynchronous commit to outlive the `drm_device` reference inherited from its ioctl context. Successful exploitation can cause denial of service or potentially local privilege escalation; Red Hat assigns a CVSS v3.1 score of 7.0. The issue affects kernels before version 6.4.5 and was fixed upstream in commit `4e076c73e4f6e90816b30fcd4a0d7ab365087255`, which makes each `drm_atomic_state` retain a `drm_device` reference until the atomic state is freed. Red Hat identified affected RHEL 8 and 9, including selected Extended Update Support, real-time kernel, and Red Hat Virtualization releases, and issued kernel updates. Organizations should deploy the applicable kernel updates; where patching is not immediately possible, Red Hat recommends preventing the DRM kernel module from loading.
Aug 26, 2026