Loading story…
Google Project Zero released MAccConc, a prototype toolkit for systematically testing Linux kernel race conditions by tracing memory accesses and injecting execution delays to force selected thread orderings. Using KASAN/ASAN outline instrumentation with KCOV, it identifies conflicting cross-thread accesses to the same memory region as communication points, then uses count-augmented stack traces and ordering constraints to reproduce target interleavings without modifying kernel source code. The tooling includes automated A-B-A interleaving tests plus terminal and graphical interfaces; a dup()/close() demonstration forced reuse of a file descriptor closed by a concurrent thread.
The approach can validate known flaws and aid discovery of new kernel concurrency bugs, including the n_hdlc race tracked as CVE-2017-2636, where concurrent flush_tx_queue() and n_hdlc_send_frames() operations can cause a double free and local privilege escalation to root. MAccConc currently has coverage and scalability constraints: ASAN outline instrumentation misses many direct stack-object accesses, and exhaustive interleaving searches become impractical for large syzkaller reproducers. Required LLVM support shipped in LLVM 23.1.0, while the associated Linux kernel patches had not yet been upstreamed at publication.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Project Zero published MAccConc (Memory Access Concurrency), a prototype toolset that traces kernel memory accesses, identifies conflicting cross-thread communication points, and injects delays to test selected execution orderings.
syzkaller detected a suspicious crash associated with the n_hdlc driver race. The flaw can cause a double free through concurrent flush_tx_queue() and n_hdlc_send_frames() activity.
Linux commit be10eb75893 introduced a race condition in the n_hdlc driver, later tracked as CVE-2017-2636.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcelinuxsecurity.com
Open sourceprojectzero.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel's ELF core-dump handling allowed concurrent `userfaultfd` virtual-memory-area (VMA) modifications to merge and free VMAs while `elf_core_dump()` was iterating them. The flaw, present since `userfaultfd` was introduced in Linux 4.3, created a kernel use-after-free condition; proof-of-concept code triggered it under KASAN and separately demonstrated kernel heap-data disclosure. The race could also desynchronize allocation and use of the `vma_filesz` array, potentially permitting kernel-memory disclosure and constrained out-of-bounds writes. Linux merged a fix into the mainline tree and backported it to stable releases **4.14.114**, **4.19.37**, and **5.0.10**; organizations running affected kernel branches should deploy those or later updates.
Aug 28, 2026
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing **x86 page-fault handling** logic flaw and newly optimized **page-cache side-channel** techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 `do_page_fault()` path could leave **hardware interrupts** enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into **Linux 6.19** with plans to backport to stable branches. Separately, researchers from Graz University of Technology described significantly faster Linux **page cache attacks**, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only **CVE-2025-21691** has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated **GPU DDK** issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Jun 29, 2026
**CVE-2024-26923** is a race condition in the Linux kernel's AF_UNIX socket garbage collector that occurs when garbage collection runs concurrently with `connect()` on a partially initialized socket carrying `SCM_RIGHTS` file descriptors. The race can incorrectly increase an in-flight reference count, leave a dangling pointer in `gc_inflight_list`, and cause inaccurate active-socket accounting, allowing local resource exhaustion and denial of service. The affected code is `net/unix/garbage.c`, and the issue has existed since Linux kernel 2.6.23. Exploitation requires local low-privileged access and difficult-to-reproduce timing conditions, but Red Hat assigns a Moderate severity rating with CVSS 7.0. Fixed upstream kernels include 5.15.156, 6.1.87, 6.6.28, 6.8.7, and 6.9-rc4; Red Hat has issued corrected kernel packages for multiple RHEL 8 and RHEL 9 streams. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; no separate mitigation is known.
Aug 26, 2026