Loading story…
Linux kernel maintainers addressed a page-cache memory-management use-after-free vulnerability in filemap_map_pages(), tracked as CVE-2026-31554. Kernel AddressSanitizer (KASAN) reproduced the flaw, and the corrective patch was prepared for stable-kernel testing.
The vulnerability affects kernel versions earlier than 6.12.80, 6.18.21, 6.19.11, and 7.0 in their respective release branches. Updated kernel releases are available; organizations should identify systems running affected versions and prioritize kernel upgrades through their established patch-management process.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A KISA/KrCERT advisory identified CVE-2026-31554 as a Linux kernel use-after-free vulnerability affecting releases before 6.12.80, 6.18.21, 6.19.11, and 7.0 in their respective branches. It advised affected users to upgrade to the listed fixed kernel releases.
Kernel AddressSanitizer reproduced a use-after-free condition in filemap_map_pages(). On September 3, 2026, Andrew Morton said he would revise the changelog, add the patch to the stable-kernel mailing list, and queue it for testing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026
Two Linux kernel use-after-free vulnerabilities were disclosed in packet-filtering components, exposing systems to local privilege escalation. **CVE-2026-23111** affects the `nftables` subsystem and stems from an inverted conditional in `nft_map_catchall_activate()` that mishandles catchall elements during transaction aborts, leaving a dangling chain reference. A public technical write-up and working exploit showed the bug can achieve root privileges with high reliability on Debian Bookworm, Debian Trixie, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS by corrupting chain reference counts, bypassing KASLR, leaking heap addresses, hijacking control flow with a fake `nft_expr_ops` structure, and executing a ROP chain that calls `commit_creds(&init_cred)`. The exploit also uses `switch_task_namespaces()` to break out of namespaces and containers. A separate flaw, **CVE-2026-23412**, affects the Linux kernel’s BPF netfilter link implementation in `nf_bpf_link.c`, where synchronous deallocation of `bpf_nf_link_lops` allowed concurrent `nfnetlink` hook enumeration to access freed memory during BPF link destruction. Researchers reproduced KASAN slab-use-after-free crashes in `nfnl_hook_dump_one` on kernel `6.14.0` and said the bug could be exploited through heap spraying and function-pointer hijacking in the `kmalloc-192` slab cache. The issue was introduced in `6.4-rc1` and fixed in `7.0-rc5` by commit `24f90fa3994b`, which switches to RCU-deferred freeing, while the `nftables` bug was patched upstream by commit `f41c5d1`; administrators were urged to deploy patched kernels promptly.
Jun 29, 2026
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026