Loading story…
CVE-2024-46679 is a moderate-severity Linux kernel flaw in ethtool link-settings handling that can cause a kernel panic when a sysfs reader races with a network device being reset or removed. The issue, observed in the qede driver path, permits __ethtool_get_link_ksettings() callers to access device state after it is no longer present, affecting availability only. It has a CVSS v3.1 score of 4.7 and requires local access, low privileges, and high attack complexity.
The defect has existed since Linux 2.6.33 and affects net/core/net-sysfs.c and net/ethtool/ioctl.c. Upstream fixes add a device-presence check for all ethtool callers and are included in stable kernels 5.4.283, 5.10.225, 5.15.166, 6.1.108, 6.6.49, 6.10.8, and 6.11-rc6. Red Hat issued fixes for affected RHEL 8 and 9 streams through errata including RHSA-2024:8107, RHSA-2024:8856, and RHSA-2024:10274; organizations should apply the applicable vendor kernel updates, noting that Red Hat may backport fixes without changing to the listed upstream version.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:8856 with fixed kernel packages for affected Red Hat Enterprise Linux 8 product streams.
Red Hat issued RHSA-2024:8107, providing fixed kernel packages for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat issued RHSA-2025:23445 for RHEL 8.2 Advanced Update Support and RHSA-2025:23463 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On packages.
Red Hat issued RHSA-2025:22006 for RHEL 8.6 Advanced Mission Critical, Telecommunications, and SAP Solutions services, and RHSA-2025:22095 for RHEL 9.2 SAP Solutions Update Services.
Red Hat issued RHSA-2024:10274, providing fixed kernel packages for Red Hat Enterprise Linux 9.
Fixes moved the network-device presence check into ethtool to protect all callers of __ethtool_get_link_ksettings(). Fixed stable releases include 5.4.283, 5.10.225, 5.15.166, 6.1.108, 6.6.49, 6.10.8, and 6.11-rc6.
The Linux kernel CVE team assigned CVE-2024-46679 to a race in which link settings may be read after a network device has been reset or removed, potentially causing a kernel panic.
The device-presence handling flaw underlying CVE-2024-46679 was introduced by commit d519e17e2d01 in Linux kernel version 2.6.33, affecting net-sysfs and ethtool link-settings handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47284** affects the Linux kernel's mISDN Netjet ISDN driver (`drivers/isdn/hardware/mISDN/netjet.c`). When `nj_setup` fails with `-EIO` after the driver initializes `card->irq`, its cleanup routine can call `free_irq` for an interrupt that was never requested. This produces a kernel warning and can crash the system when `panic_on_warn` is enabled, creating a locally exploitable availability risk for systems using the affected hardware. The fix removes the premature IRQ assignment and preserves assignment immediately before `request_irq`. Fixed Linux stable releases include 4.4.273, 4.9.273, 4.14.237, 4.19.195, 5.4.126, 5.10.44, 5.12.11, and 5.13; organizations should deploy a current stable kernel. Red Hat rated the issue **Low** severity (CVSS 3.1: 5.5) and issued fixes for RHEL 8 `kernel` and `kernel-rt`; RHEL 9 is not affected, while RHEL 6 and 7 are out of support.
Aug 26, 2026
**CVE-2022-48619** is a moderate-severity denial-of-service flaw in the Linux kernel input subsystem's `input_set_capability()` function. The function failed to validate event codes against the bitmap bounds for the specified event type, allowing a low-privileged local attacker to cause a kernel panic. Red Hat assigned a CVSS v3.1 score of 5.5, reflecting high availability impact with no confidentiality or integrity impact. Upstream fixed the defect in Linux kernel 5.17.10 through commit `409353cbe9fe48f6bc196114c442b1cff05a39bc`, which adds per-event-type maximum-code validation and rejects invalid values. Red Hat remediated affected RHEL 8 kernel and `kernel-rt` packages through advisories **RHSA-2024:7000** and **RHSA-2024:7001**; RHEL 9 variants are not affected, while RHEL 6 and 7 are outside support scope.
Aug 26, 2026
**CVE-2025-39883** is a use-after-free flaw in the Linux kernel's memory-failure handling that can cause a kernel panic when memory is unpoisoned. An attacker with local, low-privileged access can provide an offline memory PFN through the `hwpoison` debugfs interface, leading `unpoison_memory()` to inspect the `PG_HWPoison` flag on an uninitialized page and trigger `VM_BUG_ON_PAGE(PagePoisoned(page))`. The defect has existed since Linux kernel 4.13 and affects system availability and potentially integrity. Fixes are available in stable kernel releases 6.1.153, 6.6.107, 6.12.48, 6.16.8, and 6.17-rc6; the Linux kernel CVE team advises updating to a current stable release rather than cherry-picking patches. Red Hat rates the issue Moderate, with a CVSS 3.1 score of 7.0, and has issued fixes for multiple Red Hat Enterprise Linux 8 and 10 kernel streams; it reports no qualifying mitigation.
Aug 25, 2026