Loading story…
A proposed Linux kernel patch addresses a potential use-after-free condition in the fprobe_return() tracing path on systems configured with preemptible RCU. The return handler previously disabled preemption, which prevents task migration but does not create the RCU read-side critical section needed to prevent unregister_fprobe() from freeing an fprobe object while a return callback still references it.
The patch replaces the preemption-only protection with guard(rcu)(), bringing the return path in line with fprobe’s entry handling and deferring object reclamation until active callbacks complete. The change remains under upstream review; no CVE, confirmed affected-version list, public proof of concept, or evidence of unprivileged exploitation has been reported.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A Linux kernel patch was proposed to protect fprobe_return() with guard(rcu)(), addressing a potential use-after-free race on preemptible RCU kernels during fprobe or asynchronous BPF multi-kprobe unregistration. The patch was under upstream review, with no CVE, public reproducer, or demonstrated exploitation reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-56675** is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its `perf_event`; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. Red Hat rated the issue **Moderate** (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring `CAP_SYS_ADMIN` or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
Aug 26, 2026
Red Hat released Moderate-severity kernel updates for Red Hat Enterprise Linux 9 and RHEL 9.4 Extended Update Support that remediate **CVE-2024-47675**, a use-after-free flaw in `bpf_uprobe_multi_link_attach()`. If `bpf_link_prime()` fails, an error path can free an array of `bpf_uprobe` objects without unregistering them, leaving a freed consumer on the uprobe consumer list and leaking the associated uprobe object. The fix is included in RHSA-2024:10942 for the RHEL 9.4 kernel `5.14.0-427.48.1.el9_4` and RHSA-2024:11486 for RHEL 9. These advisories also address additional kernel flaws affecting components including BPF, Bluetooth, NFS, XFRM, KVM, ARM64 probes, GICv4, and NUMA scheduling across x86_64, ARM64, IBM z, and Power architectures. Organizations should apply the applicable updated kernel packages and reboot systems for remediation to take effect.
Aug 26, 2026
**CVE-2022-49977** is a Linux kernel `ftrace` flaw that can trigger a NULL-pointer dereference and kernel OOPS after `ftrace` is disabled following a failed startup-enable operation. A failed `ftrace_startup_enable` can leave an operation registered in `ftrace_ops_list`; because `unregister_ftrace_function` exits early when `ftrace_disabled` is set, a later access can dereference a freed dynamically allocated operation in `is_ftrace_trampoline`. Syzkaller reproduced the crash on Linux 5.10.0. The defect is fixed in stable kernel versions 4.9.327, 4.14.292, 4.19.257, 5.4.212, 5.10.141, 5.15.65, 5.19.7, and 6.0 and later. Red Hat rated the issue **Moderate** with a CVSS v3.1 score of 7.0 and released corrected `kernel` and `kernel-rt` packages for Red Hat Enterprise Linux 8 and applicable extended-support variants; organizations should update affected kernels to vendor-supported fixed releases.
Aug 26, 2026