Loading story…
CVE-2015-8830 affects older 64-bit Linux kernels where asynchronous I/O (io_submit) can submit an oversized IOCB_CMD_PWRITE request to network-protocol sendmsg handlers. In the L2TP PPP path, the length can integer-overflow during socket-buffer allocation, corrupting kernel heap memory and potentially allowing an unprivileged local user to escalate privileges. Google Project Zero validated a proof of concept on a fully patched Ubuntu 14.04 LTS server; 3.10- and 3.18-based kernels were affected, and 64-bit Android devices using Linux 3.10 were considered likely vulnerable.
Linux kernel changes to AIO request setup added initialization handling and capped single-vector request lengths at MAX_RW_COUNT, preventing oversized requests from reaching vulnerable protocol handlers. The flaw was fixed upstream after disclosure and is distinct from CVE-2012-6701, an earlier AIO validation issue addressed in Linux v3.5-rc1. Organizations operating legacy Linux or Android kernels should ensure vendor security updates incorporating the AIO length-validation fix are deployed.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Google Project Zero marked the Linux L2TP PPP socket sendmsg vulnerability fixed. The issue affected older 64-bit branches including 3.10 and 3.18; the proof of concept had been tested on Ubuntu 14.04 LTS.
A patch addressing the Linux io_submit L2TP sendmsg integer-overflow vulnerability was released on the Linux Kernel Mailing List.
Google Project Zero reported that an unprivileged local user could use io_submit with an oversized IOCB_CMD_PWRITE request to trigger an integer overflow in the L2TP PPP sendmsg path, causing kernel heap corruption and potentially local privilege escalation.
Red Hat stated that RHEL 5 was not affected by CVE-2015-8830, while RHEL 6 and RHEL 7 were affected or had been affected.
A Linux kernel patch changed fs/aio.c to clamp oversized single-vector AIO request lengths to MAX_RW_COUNT and initialize iov_iter during AIO request setup. The patch does not identify a CVE or explicitly state a security impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcebugs.chromium.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-40047** is a use-after-free vulnerability in the Linux kernel's `io_uring` `IORING_OP_WAITID` operation. A low-privileged local attacker can race cancellation handling in `io_waitid_wait()` because a wait-queue entry may not be pruned after a successful return, permitting repeated callbacks, list corruption, a system crash, or potential privilege escalation. The flaw was introduced in Linux kernel 6.7. The issue is fixed in Linux kernel versions 6.12.53, 6.17.3, and 6.18-rc1; maintainers recommend upgrading to a current stable release rather than cherry-picking the patch. Red Hat rated the vulnerability 7.8 under CVSS v3.1 and released fixes for supported Red Hat Enterprise Linux 9 and 10 kernel streams, while the RHEL 9 `kernel-rt` stream remains affected.
Aug 25, 2026
A flaw in the Linux kernel's Bluetooth management (`MGMT`) component, tracked as **CVE-2026-43020**, was fixed after maintainers found that Long Term Key (`LTK`) `enc_size` values were not properly validated during load operations. An attacker with local low-privilege access could supply an `enc_size` larger than the 16-byte key buffer, allowing invalid data to be stored and later used in fixed-size stack operations when the kernel replied to LE LTK requests, creating a stack buffer overflow condition with denial-of-service and possible broader memory-corruption impact. The vulnerable code is in `net/bluetooth/mgmt.c` and has reportedly been present since Linux kernel 3.4. Upstream fixes were released across multiple stable branches, including 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0, by rejecting oversized `enc_size` values during management LTK record validation. Red Hat said fixes were issued for Red Hat Enterprise Linux 8, 9, and 10 through RHSA advisories, while RHEL 7, RHEL 7 `kernel-rt`, and RHEL 9 `kernel-rt` remained listed as affected at publication; RHEL 6 was listed as not affected because the vulnerable code is absent.
Aug 25, 2026
**CVE-2022-20141** is a use-after-free flaw in the Linux kernel IPv4 IGMP implementation, in `ip_check_mc_rcu` within `net/ipv4/igmp.c`. Improper locking allows a local low-privileged user to race repeated opening and closing of IGMP inet sockets, potentially causing a kernel crash or escalating privileges; Android tracked the issue as **A-112551163**. Red Hat rated the vulnerability Moderate with a CVSS v3.1 score of 7.0, noting that reliable exploitation has high complexity and that no reproducer was known. Fixes were released for Red Hat Enterprise Linux 8 and 9, including real-time kernel packages, and Fedora incorporated fixes in stable kernel 5.13.16 updates; RHEL 6 was not affected and RHEL 7 was outside support scope.
Aug 26, 2026