Loading story…
A race condition in the Linux kernel's ELF core-dump handling allowed concurrent userfaultfd virtual-memory-area (VMA) modifications to merge and free VMAs while elf_core_dump() was iterating them. The flaw, present since userfaultfd was introduced in Linux 4.3, created a kernel use-after-free condition; proof-of-concept code triggered it under KASAN and separately demonstrated kernel heap-data disclosure.
The race could also desynchronize allocation and use of the vma_filesz array, potentially permitting kernel-memory disclosure and constrained out-of-bounds writes. Linux merged a fix into the mainline tree and backported it to stable releases 4.14.114, 4.19.37, and 5.0.10; organizations running affected kernel branches should deploy those or later updates.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Project Zero issue for the Linux ELF core-dump/userfaultfd race condition was marked fixed.
The fix was merged into Linus Torvalds' Linux tree as commit 04f5866e41fb70690e28397487d8bd8eea7d712a and backported to stable releases 4.14.114, 4.19.37, and 5.0.10.
A patch addressing the missing locking between ELF core-dump processing and userfaultfd-driven VMA modification was posted publicly to the Linux memory-management mailing list.
After userfaultfd was introduced in Linux v4.3, concurrent userfaultfd VMA operations could merge or free VMAs while elf_core_dump() iterated them, creating a use-after-free and vma_filesz memory-disclosure and constrained out-of-bounds-write risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegit.kernel.org
Open sourcebugs.chromium.org
Open sourcecdn.kernel.org
Open sourcecdn.kernel.org
Open sourcecdn.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47461** is a race condition in the Linux kernel's `userfaultfd` subsystem, triggered when `userfaultfd_writeprotect()` runs concurrently with `exit_mmap()` as a process exits and its virtual-memory areas are removed. Introduced in kernel 5.7, the flaw was detected with KASAN and can affect confidentiality, integrity, and availability; Red Hat rated it CVSS 7.0, while NVD assigned 4.7 primarily for availability impact. The upstream issue is fixed in Linux stable releases 5.10.76, 5.14.15, and 5.15 and later. Red Hat released corrected RHEL 8 `kernel` and `kernel-rt` packages through errata issued between August and November 2024; RHEL 9 is not affected, while RHEL 6 and 7 are outside supported remediation scope. Organizations should deploy a current vendor-supported kernel release rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2022-49977** is a Linux kernel `ftrace` flaw that can trigger a NULL-pointer dereference and kernel OOPS after `ftrace` is disabled following a failed startup-enable operation. A failed `ftrace_startup_enable` can leave an operation registered in `ftrace_ops_list`; because `unregister_ftrace_function` exits early when `ftrace_disabled` is set, a later access can dereference a freed dynamically allocated operation in `is_ftrace_trampoline`. Syzkaller reproduced the crash on Linux 5.10.0. The defect is fixed in stable kernel versions 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7, and 6.0 and later. Red Hat rated the issue **Moderate** with a CVSS v3.1 score of 7.0 and released corrected `kernel` and `kernel-rt` packages for Red Hat Enterprise Linux 8 and applicable extended-support variants; organizations should update affected kernels to vendor-supported fixed releases.
Aug 26, 2026
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026