Loading story…
CVE-2022-2959 is a Linux kernel race condition in the watch queue implementation that can allow a local, low-privileged attacker to escalate privileges or cause a denial of service. Missing synchronization in pipe_resize_ring() permits a process resizing a watch-queue pipe through ioctl(IOC_WATCH_QUEUE_SET_SIZE) to race with a keyctl()-triggered notification, resulting in access to a freed buffer.
The flaw is categorized as CWE-820: Missing Synchronization, in which concurrent unsynchronized access to shared resources can produce an unexpected state and enable data disclosure, modification, or altered execution logic. Red Hat assigned CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); RHEL 6–8 are unaffected because they lack general notification queue support, while fixes were issued for affected RHEL 9 kernel, kernel-rt, and kpatch-patch packages.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:0334, RHSA-2023:0300, and RHSA-2023:0348, fixing the Linux kernel watch-queue race condition in RHEL 9 kernel, kernel-rt, and kpatch-patch packages.
Red Hat issued RHSA-2022:9082 to fix CVE-2022-2959 in Red Hat Enterprise Linux 9.0 Extended Update Support kpatch-patch packages.
Red Hat issued RHSA-2022:8973 and RHSA-2022:8974 to fix CVE-2022-2959 in Red Hat Enterprise Linux 9.0 Extended Update Support kernel and kernel-rt packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-1882** is a use-after-free flaw in the Linux kernel's pipe notification and watch-queue functionality. A race between `post_one_notification()` and `free_pipe_info()` can leave `watch_queue->pipe` pointing to freed memory, allowing a local authenticated attacker to crash the host or potentially elevate privileges. The vulnerability was introduced by commit `db8facfc9fafacefe8a835` and requires a difficult-to-win race condition; Red Hat rated it Moderate (CVSS 7.0), while NVD assigned CVSS 7.8. Upstream Linux fixed the issue before kernel `5.18` final, with the remediation included in Fedora stable kernel `5.18.15`. The patch serializes access to watch queues and their destruction state through new locking helpers, preventing notification paths from accessing invalid pipes or defunct queues. Red Hat remediated affected Red Hat Enterprise Linux 9 `kernel` and `kernel-rt` packages through RHSA-2023:2148 and RHSA-2023:2458; listed RHEL 6, 7, and 8 kernel variants were not affected.
Aug 26, 2026
**CVE-2025-40047** is a use-after-free vulnerability in the Linux kernel's `io_uring` `IORING_OP_WAITID` operation. A low-privileged local attacker can race cancellation handling in `io_waitid_wait()` because a wait-queue entry may not be pruned after a successful return, permitting repeated callbacks, list corruption, a system crash, or potential privilege escalation. The flaw was introduced in Linux kernel 6.7. The issue is fixed in Linux kernel versions 6.12.53, 6.17.3, and 6.18-rc1; maintainers recommend upgrading to a current stable release rather than cherry-picking the patch. Red Hat rated the vulnerability 7.8 under CVSS v3.1 and released fixes for supported Red Hat Enterprise Linux 9 and 10 kernel streams, while the RHEL 9 `kernel-rt` stream remains affected.
Aug 25, 2026
**CVE-2025-38352** is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between `handle_posix_cpu_timers()` and `posix_cpu_timer_del()` while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available. Red Hat released fixes across affected kernel packages, including `kernel-rt-4.18.0-553.74.1.rt7.415.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
Aug 26, 2026