Loading story…
CVE-2024-41009 is an out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation. A privileged local attacker can manipulate the consumer position and the ring buffer's double-mapped circular layout to obtain overlapping record reservations, then alter an earlier record header so that bpf_ringbuf_commit() accesses an incorrect page, potentially crashing the kernel. The weakness is associated with CWE-121, stack-based buffer overflow, and affects the handling of outstanding BPF ring-buffer records.
The upstream fix tracks the oldest pending record position and rejects reservations when the range of outstanding records would exceed the ring-buffer size. Red Hat rates the issue Moderate (CVSS 3.1: 4.4), requiring local high privileges and primarily enabling denial of service; NVD assigns 5.5, while CVE.org reports 7.8 with confidentiality and integrity impacts. Red Hat issued kernel updates for multiple RHEL 8 and RHEL 9 streams, including extended-support variants, and reports no qualifying mitigation beyond applying the updates.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:8856 for the RHEL 8 kernel and RHSA-2024:8870 for RHEL 8 kernel-rt, addressing CVE-2024-41009.
Red Hat issued RHSA-2024:6753 with kernel fixes for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2024:10771 for RHEL 9.4 Extended Update Support and RHSA-2024:10772 and RHSA-2024:10773 for RHEL 9.2 Extended Update Support kernel and kernel-rt packages.
Red Hat issued RHSA-2024:10262 for RHEL 8.8 Extended Update Support and RHSA-2024:10274 for RHEL 9, providing kernel fixes for the BPF ring-buffer vulnerability.
An out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation allowed manipulated reservations to overlap an earlier record and potentially corrupt its header, enabling a local attacker to crash the kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcecwe.mitre.org
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-58088** is a Linux kernel BPF flaw that lets a sufficiently privileged local attacker cause a system deadlock while cgroup local storage is being freed. Introduced in kernel 6.2, the affected `BPF_MAP_TYPE_CGRP_STORAGE` cleanup path passed a null busy counter to `bpf_local_storage_map_free()`, enabling a BPF program invoked during cleanup to recursively access storage and attempt to reacquire an already held local-storage lock. Repeated creation and destruction of crafted BPF programs can leave a worker thread deadlocked, causing an availability impact. The issue is fixed upstream in Linux 6.6.80, 6.12.17, 6.13.5, and 6.14-rc4 and later; administrators should deploy a current stable kernel rather than cherry-pick the patch. Red Hat rates the issue Moderate (CVSS 4.4) and has issued fixes for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 9 `kernel-rt` is affected, while RHEL 6, 7, 8 and their listed real-time kernel variants lack the vulnerable code.
Aug 26, 2026
**CVE-2023-45871** is an Important-rated buffer overflow in the Linux kernel’s Intel IGB Ethernet driver. When `rx-all`/store-bad-packet behavior is enabled, an oversized physical-layer frame can overflow a receive-ring buffer in `igb_configure_rx_ring`, potentially compromising system confidentiality, integrity, and availability. Red Hat assigned the flaw a CVSS v3.1 score of 7.5; exploitation requires an adjacent-network attacker and is considered high complexity because it depends on oversized frames and a non-default configuration. The upstream kernel fix updates `igb_set_rx_buffer_len` to allocate large receive buffers on systems with page sizes below 8192 bytes when either frames exceed `IGB_MAX_FRAME_BUILD_SKB` or the `E1000_RCTL_SBP` receive-control flag is set. Red Hat released corrected kernel, `kernel-rt`, and `kpatch` packages for affected Red Hat Enterprise Linux 7 and 8 streams in February and March 2024, with no qualifying mitigation listed at the time of its advisory.
Aug 26, 2026
Red Hat resolved **CVE-2024-54456**, a moderate-severity buffer-overflow flaw in the Linux kernel NFS client function `nfs_sysfs_link_rpc_client()`. The function appended an RPC program name of unknown length to a fixed 64-byte buffer using unsafe `strcat()` operations, creating a CWE-120 classic buffer-overflow condition. A local low-privileged attacker could potentially disclose information, corrupt memory, execute unauthorized code or commands, or cause a denial of service; Red Hat rates the issue CVSS 7.1, while NVD and CVE.org score it 7.8. The upstream remediation replaces the unsafe string handling with bounded `strscpy()` and `strncat()` calls. Red Hat issued corrected kernels for RHEL 9 and RHEL 10 and later supplied a fix for RHEL 9.6 Extended Update Support; organizations should apply the applicable kernel advisories and reboot into the updated kernel. Red Hat states that the RHEL 9 `kernel-rt` package will not receive a fix, and RHEL 8 is outside the supported remediation scope.
Aug 26, 2026