Loading story…
A KASAN-detected use-after-free race affects Linux kernel RxRPC during network-namespace teardown. In the failing path, rxrpc_destroy_all_peers traverses peer records and attempts to lock a peer that asynchronous RCU-based cleanup has already released, creating a memory-lifetime flaw during repeated namespace destruction.
Kernel maintainers rejected a global rcu_barrier() mitigation because it could block on unrelated callbacks across the system. They instead favor using the pernet_operations pre_exit lifecycle hook to drain RxRPC activity before namespace state becomes invalid; no CVE, confirmed exploit path, affected-version range, or final upstream fix has been established. Linux teams should stress-test network-namespace creation and teardown under KASAN and monitor upstream patches and stable backports.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
During review of the proposed remediation, Eric Dumazet rejected using a global rcu_barrier() because it would wait for unrelated callbacks across the system. He recommended using the pernet_operations pre_exit lifecycle hook to drain RxRPC activity while namespace state remains valid.
A patch review identified a KASAN-detected use-after-free in RxRPC's rxrpc_destroy_all_peers during network-namespace removal, where code could lock a peer already released through asynchronous RCU cleanup. The associated syzbot report included a reproducer and KASAN stack trace.
A separate report described RxRPC connection destruction being moved before network-namespace cleanup had completed. The source states that this issue is distinct and does not establish a shared root cause with the peer use-after-free race.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bynario disclosed **CVE-2026-31532**, a Linux kernel use-after-free flaw in `net/can/` affecting SocketCAN `CAN_RAW` sockets since **v4.1**. The bug stems from a race between `raw_release()` and `raw_rcv()`: the kernel frees the per-CPU `ro->uniq` structure before RCU-deferred receiver callbacks have fully drained, allowing concurrent CAN frame reception to access freed memory. The issue can cause kernel memory corruption and may enable **local privilege escalation** where CAN support is reachable, including through **virtual CAN interfaces** commonly used for testing and development. The vendor said its pipeline both discovered and validated the flaw, and a proof of concept reliably triggered the race through concurrent sender activity and socket teardown. An upstream fix was accepted that moves `free_percpu(ro->uniq)` out of `raw_release()` and into a socket destructor so memory is released only after the relevant RCU-protected callbacks complete. In a related evaluation of AI-assisted kernel research, Bynario reported that frontier models consistently found and validated this bug more effectively than small local models, although orchestrated local models improved substantially in discovery performance.
Aug 20, 2026
**CVE-2023-52623** is a Linux kernel SUNRPC flaw in `net/sunrpc/xprtmultipath.c` that permits traversal of an RCU-protected list without an RCU read-side lock. The issue was observed during `cthon` testing against an ONTAP server using pNFS, where it generated an RCU warning. A low-privileged local user can exploit the condition without user interaction, with availability as the rated impact; Red Hat assigns a CVSS v3.1 score of 5.5 and classifies it as CWE-362. The upstream fix changes `rpc_xprt_switch_has_addr()` to always acquire `rcu_read_lock()`, including when invoked by callers that already hold the lock. Corrected stable kernels include 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, and 6.8. Red Hat has released fixes for affected RHEL 8 `kernel` and `kernel-rt` packages and RHEL 9.4 Extended Update Support; RHEL 9 remains affected, while its `kernel-rt` fix is deferred. Organizations should deploy current vendor-supported kernel updates rather than cherry-picking the upstream patch.
Aug 26, 2026
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026