Loading story…
CVE-2024-26894 is a low-severity Linux kernel flaw in the ACPI processor-idle subsystem. In acpi_processor_power_exit(), a CPU idle device is unregistered but its allocated memory is not freed, creating a CWE-401 memory leak. Introduced in kernel version 3.7, the defect can accumulate memory consumption and, under local privileged conditions, degrade reliability or cause denial of service through resource exhaustion or system instability. Red Hat assigned a CVSS v3.1 score of 6.0.
Upstream Linux fixed the issue in stable kernels 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1; maintainers recommend updating to a current stable kernel rather than applying only the individual patch. Red Hat released corrected kernel packages for RHEL 8 and RHEL 9, including RHEL 9.4 Extended Update Support, while the RHEL 9 kernel-rt package remained affected; RHEL 6 and 7 are outside supported scope.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt, addressing CVE-2024-26894.
The Linux kernel CVE team assigned CVE-2024-26894 to the ACPI processor-idle memory leak, which had been introduced in Linux kernel version 3.7. The issue was reported by Robb Gatica.
The Linux kernel issue in acpi_processor_power_exit(), which failed to free a CPU idle device after unregistering it, was resolved upstream. Fixed stable versions included 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, and 6.9-rc1.
Red Hat released RHSA-2025:2270 to address CVE-2024-26894 in the RHEL 9.4 Extended Update Support kernel.
Red Hat released RHSA-2024:9315, providing a fix for CVE-2024-26894 in the RHEL 9 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47289** is a moderate-severity Linux kernel flaw in ACPI device reference handling. A code path introduced by commit `71f642833284` could invoke `acpi_dev_put()` with a NULL pointer, leading the helper to call `put_device()` using an invalid offset and potentially crash the host. Red Hat assigned a CVSS v3.1 score of 5.5, reflecting low-complexity local exploitation with high availability impact. Upstream fixed the issue by making `acpi_dev_put()` safely handle NULL pointers; fixes are included in kernel versions 5.4.139, 5.10.57, 5.13.6, and 5.14 and later stable releases. Red Hat remediated affected RHEL 8 kernel and kernel-rt packages through RHSA-2024:7000 and RHSA-2024:7001, while RHEL 6 and 7 are outside support scope and should be treated as vulnerable unless otherwise mitigated.
Aug 26, 2026
Red Hat addressed **CVE-2021-47287**, a Linux kernel driver-core flaw in `drivers/base/auxiliary.c` that leaks memory when `driver_register()` fails. In the affected `__auxiliary_driver_register()` path, memory allocated for `auxdrv->driver.name` was not released before the function returned, creating a local denial-of-service risk through resource exhaustion. Red Hat assigns the issue a CVSS 3.1 score of 5.5 (medium), with low-privilege local access required and availability as the affected security property. The defect was introduced in Linux kernel 5.11 and fixed upstream in versions 5.13.6 and 5.14. Red Hat released fixes for affected RHEL 8 `kernel` and `kernel-rt` packages through **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 6, 7, and 9 kernel variants are listed as not affected. Organizations running affected RHEL 8 systems should apply the advisory updates and reboot into the updated kernel; upstream recommends using the latest stable kernel release rather than cherry-picking the patch.
Aug 26, 2026
**CVE-2021-47466** affects the Linux kernel's SLUB allocator in `mm/slub.c`, where the error path in `kmem_cache_open()` can fail to release a cache's `random_seq` resource after initialization fails. Introduced in kernel version 4.8, the flaw can cause a memory leak and potentially degrade system availability. It carries a CVSS v3.1 score of 5.5 and requires local access with low privileges. Upstream fixes are available in kernel versions 5.4.156, 5.10.76, 5.14.15, and 5.15 and later; the Linux kernel CVE team recommends deploying a current stable kernel rather than backporting an individual patch. Red Hat remediated affected RHEL 8 kernel and `kernel-rt` packages through advisories **RHSA-2024:7000** and **RHSA-2024:7001**. RHEL 9 and its real-time kernel are not affected, while unsupported RHEL 6 and 7 deployments should be treated as potentially vulnerable unless separately mitigated or upgraded.
Aug 26, 2026