Loading story…
Linux fixed CVE-2016-3672, a flaw that allowed users on x86 systems to disable Address Space Layout Randomization (ASLR) when launching 32-bit applications by setting the RLIMIT_STACK resource limit to unlimited. The issue was reported by Hector Marco-Gisbert and affected then-current Linux systems.
By disabling ASLR, the condition made process memory locations predictable and weakened a key exploit mitigation, increasing the reliability of memory-corruption attacks. Organizations running affected Linux kernels should apply the available kernel updates, particularly where untrusted users can execute 32-bit binaries.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Hector Marco-Gisbert disclosed CVE-2016-3672 on the Bugtraq mailing list, describing the Linux ASLR bypass that remained present in then-current systems.
Hector Marco-Gisbert reported that a longstanding Linux x86 ASLR weakness, in which users running 32-bit applications could disable ASLR by setting RLIMIT_STACK to unlimited, had been fixed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-25265** is a Linux kernel executable-space-protection bypass affecting kernels through 5.16.10. On x86_64 systems, a deliberately crafted 32-bit ELF executable that omits the `PT_GNU_STACK` header can be treated as requiring an executable stack, allowing code execution from file-backed regions that should be non-executable. The condition affects certain legacy binaries, including software built with GCC 3.2.2-era toolchains for systems without NX support; 64-bit executables are not affected. A public proof of concept demonstrated building such a binary on Slackware 9 with Linux 2.4.20 and running machine code copied into a character buffer on a modern Linux 5.16.1 system, producing effectively RWX mapped memory. Red Hat rated the issue CVSS 7.8 and issued RHEL 8 kernel and real-time kernel fixes through **RHSA-2023:2736**, **RHSA-2023:2951**, and **RHSA-2024:0724** for RHEL 8.6 EUS. RHEL 6 and 7 are unsupported, while RHEL 9 does not support 32-bit binaries; organizations should apply applicable kernel errata and identify legacy 32-bit ELF workloads.
Aug 26, 2026
**CVE-2023-0597** affects the Linux kernel’s x86 CPU-entry-area mapping, whose per-CPU structures were mapped into userspace page tables for Kernel Page-Table Isolation (KPTI) at predictable locations despite KASLR. A local low-privileged attacker could use this predictability to infer the locations of exception stacks or other sensitive kernel memory and potentially obtain unauthorized access; Red Hat rated the issue 7.0 CVSS v3.1 and noted exploitation could enable a complex arbitrary-write primitive. The upstream mitigation randomizes the placement of per-CPU CPU-entry-area structures on x86_64, assigning each possible CPU a unique randomized offset within the 512 GB P4D virtual-address region reserved for that area while retaining the existing x86_32 layout. Red Hat released fixed kernels for supported RHEL 8 and RHEL 9 streams and Red Hat Virtualization 4 on RHEL 8; RHEL 6 is unaffected, while RHEL 7 is outside support scope.
Aug 26, 2026
**CVE-2022-26373** is a moderate-severity information-disclosure flaw in certain Intel processors that support Enhanced Indirect Branch Restricted Speculation (eIBRS). Following a VM exit or an Indirect Branch Prediction Barrier (`IBPB`) event, an unbalanced near `RET` can be predicted using the address after the most recent near `CALL` executed before the VM exit, until the first post-barrier `CALL` retires. This speculative behavior can expose sensitive information; Red Hat assigned CVSS 5.5, requiring local, low-privileged access and affecting confidentiality rather than integrity or availability. Operating systems and virtual-machine monitors that execute affected unbalanced return instructions require a short software mitigation, while implementations using Return Stack Buffer stuffing are not affected. Fedora corrected the issue in stable kernel 5.18.17, and Red Hat released `kernel` and `kernel-rt` updates for affected RHEL 7, 8, and 9 streams, including relevant EUS releases and Red Hat Virtualization 4 on RHEL 8. Organizations should apply the vendor kernel updates and assess hypervisor and guest workloads for reliance on vulnerable RSB behavior.
Aug 26, 2026