Loading story…
Linux 7.3-rc3 disables EROFS LZ4 rolling decompression after AWS personnel identified rare LZ4 inputs that could corrupt data. The upstream LZ4 implementation can perform uncontrolled backward memory copies, violating EROFS's assumption that non-overlapping ranges are copied forward. The temporary mitigation favors correctness but can add substantial decompression memory use—up to 146 pages per request in a cited workload—partially offset by a reserved decompression-buffer pool.
The release candidate also contains SMB client hardening, including fixes for a potential heap overflow in DACL rewriting, oversized-DACL rejection, and malformed read-response validation, along with a Landlock use-after-free fix. EROFS rolling decompression may return if upstream LZ4 provides the required copy-direction guarantees or EROFS adopts a maintained local implementation.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Linus Torvalds issued Linux 7.3-rc3, including SMB client fixes for a potential DACL-rewriting heap overflow, oversized DACL rejection, and malformed read-response validation. The release also fixed a Landlock use-after-free issue and incorporated the EROFS LZ4 rolling-decompression disablement.
EROFS temporarily disabled LZ4 rolling decompression to prioritize correctness while the underlying corruption risk remains unresolved. The change increases temporary memory use during decompression; a reserved LZ4 buffer pool added by commit 0f6273ab4637 partially mitigates that impact.
AWS personnel identified rare LZ4 datasets for which EROFS rolling decompression could return corrupted data. The issue was traced to upstream LZ4 literal-copy behavior that can perform backward memory copies, violating EROFS rolling-window assumptions.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** libarchive security updates for affected RHEL 7 ELS, RHEL 8, and RHEL 9 releases and subscription channels, including OpenShift Container Platform and RHEL-based middleware containers. The updates remediate `CVE-2026-4424`, a heap out-of-bounds read in RAR processing: a crafted archive can exploit an LZSS dictionary-size validation error after PPMd-to-LZSS transitions to expose heap memory through `archive_read_data()` before CRC validation. Systems that automatically process untrusted archives may be remotely triggerable without authentication or user interaction. The releases also fix `CVE-2026-5121`, an ISO9660 zisofs parsing integer overflow that can allocate an undersized buffer and copy attacker-controlled data beyond its bounds. The resulting heap overflow can potentially enable arbitrary code execution on **32-bit** targets, subject to allocator- and platform-specific heap grooming; 64-bit systems do not exhibit the same integer wraparound. Organizations should update libarchive and associated `bsdtar`, `bsdcat`, and `bsdcpio` packages using the applicable Red Hat advisory—for example, RHEL 9 packages `3.5.3-9.el9_7`, RHEL 8 packages `3.3.3-7.el8_10`, and RHEL 7 ELS packages `3.1.2-14.el7_9.2`—or later supported versions.
Aug 25, 2026
Red Hat released **RHSA-2025:2270** for RHEL 9.4 Extended Update Support, updating the kernel to `5.14.0-427.57.1.el9_4` and remediating 21 vulnerabilities across EFI, memory management, networking, Open vSwitch, ACPI, ext4, SCTP, I2C, ARM64 probes, and graphics. The update applies across supported x86_64, aarch64, ppc64le, and s390x RHEL 9.4 EUS and associated update channels. The advisory includes **CVE-2024-26843**, a medium-severity potential integer overflow in EFI runtime handling of soft-reserved region sizes, and **CVE-2024-26846**, a low-severity NVMe over Fibre Channel module-exit race that can indefinitely hang module unloading and cause a local availability impact. Upstream fixes for both issues were incorporated in Linux versions 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, and 6.8; Red Hat also delivered fixes for standard RHEL 8 and 9 kernels. Systems must be rebooted after installing the updated kernel.
Aug 26, 2026
**CVE-2025-21671** is a use-after-free flaw in the Linux kernel's `zram` compressed-RAM driver. If `zram_meta_alloc` fails early, it frees `zram->table` without clearing the pointer; a local privileged user can then reset the failed, uninitialized zram device and cause `zram_meta_free` to access freed memory, potentially compromising system confidentiality, integrity, or availability. The issue is tracked as CWE-416 and is rated 6.7 (Moderate) by Red Hat, while NVD and CVE.org assign CVSS 7.8. The flaw affects stable kernel lines beginning at 6.1.122, 6.6.68, and 6.12.7, and is fixed in 6.1.127, 6.6.74, and 6.12.11; administrators should deploy current stable kernel releases rather than cherry-picking the patch. Red Hat remediated supported RHEL 10 and RHEL 9 kernels through **RHSA-2025:20095** and **RHSA-2025:20518**, respectively, while the RHEL 9 `kernel-rt` package remains affected; older unsupported kernel packages are outside Red Hat support scope.
Aug 26, 2026