Loading story…
A use-after-free vulnerability identified as CVE-2025-21887 was discovered in the Linux kernel's OverlayFS implementation, specifically involving improper handling of the dput() operation in ovl_dentry_update_reval. This flaw could potentially allow local attackers to exploit the kernel, but F5 has confirmed that none of its products are affected by this vulnerability. The issue has been resolved in the upstream Linux kernel, and vendors have begun evaluating and addressing the impact on their respective products.
Red Hat and Ubuntu have both issued security advisories urging users and administrators to apply updates to address vulnerabilities in the Linux kernel across multiple supported versions and platforms. These advisories are part of a coordinated response to recent kernel vulnerabilities, including CVE-2025-21887, ensuring that enterprise and cloud environments remain protected. Organizations are encouraged to review vendor-specific guidance and implement the recommended patches to mitigate potential risks associated with this kernel flaw.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
F5 released product advisory K000157341 concerning Linux kernel vulnerability CVE-2025-21887, indicating relevance to F5 products or components using the affected kernel. The reference does not include product impact details.
Ubuntu published a security advisory for CVE-2025-21887, signaling that Ubuntu users were notified of the issue and associated fixes or mitigations. No additional technical specifics are provided in the reference.
Red Hat issued a security advisory addressing CVE-2025-21887, indicating affected Red Hat products received or were scheduled to receive remediation guidance. The reference does not include further impact or patch details.
A Linux kernel vulnerability tracked as CVE-2025-21887 was publicly disclosed, as reflected by vendor and government advisory publications. The available references do not provide technical details or an earlier discovery date beyond the advisory publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 published product advisories covering two separate upstream security flaws affecting widely used core components: **Linux kernel** vulnerability `CVE-2025-40154` and **OpenSSL** vulnerability `CVE-2025-68160`. The notices indicate vendor tracking and assessment activity for vulnerabilities in foundational software commonly embedded in network, application delivery, and security appliances. The advisories were released through F5's product advisory channel under knowledge base articles `K000160420` and `K000160552`. While the referenced notices provide limited public synopsis text, the combined updates show F5 alerting customers to potential product impact from both an operating system kernel issue and a cryptographic library flaw, signaling the need for customers to review affected-product guidance and remediation information as it becomes available.
Jun 29, 2026
F5 published security advisories for multiple **Linux kernel** vulnerabilities, including **CVE-2024-56615**, a bug in BPF map handling where signed integer indexing in **DEVMAP/XSKMAP** can lead to **out-of-bounds (OOB) writes** during element deletion and map free operations. The fix described changes index/iterator types from `int` to `u32` to prevent OOB access, with advisory details including an example kernel crash trace originating in `dev_map_free()`. F5 also documented **CVE-2024-56626** and **CVE-2024-56627** affecting the in-kernel SMB server **ksmbd** when `vfs objects = streams_xattr` is configured in `ksmbd.conf`: a client-supplied negative offset can trigger an **OOB write** in `ksmbd_vfs_stream_write` (CVE-2024-56626) and an **OOB read** in `ksmbd_vfs_stream_read` (CVE-2024-56627). In all three advisories, F5 states there is **no impact to F5 products** (either not affected or previously resolved) and provides no customer action beyond standard kernel patching practices in affected environments.
Jun 29, 2026
F5 issued product advisories covering two separate third-party vulnerabilities affecting components used in its ecosystem: Linux kernel flaw `CVE-2021-35477` and curl flaw `CVE-2025-14017`. The notices were published through F5's security advisory portal and indicate vendor tracking of upstream issues that may affect deployed F5 products or supporting software stacks. The advisories identify the affected technologies rather than providing public synopsis details, signaling that customers should review the linked F5 notices for product impact, fixed versions, and mitigation guidance. For defenders, the immediate priority is to inventory F5 assets that rely on the Linux kernel or `curl`, validate exposure against the advisory details, and schedule remediation or compensating controls where applicable.
Jun 29, 2026