Loading story…
F5 published security advisories for multiple Linux kernel vulnerabilities, including CVE-2024-56615, a bug in BPF map handling where signed integer indexing in DEVMAP/XSKMAP can lead to out-of-bounds (OOB) writes during element deletion and map free operations. The fix described changes index/iterator types from int to u32 to prevent OOB access, with advisory details including an example kernel crash trace originating in dev_map_free().
F5 also documented CVE-2024-56626 and CVE-2024-56627 affecting the in-kernel SMB server ksmbd when vfs objects = streams_xattr is configured in ksmbd.conf: a client-supplied negative offset can trigger an OOB write in ksmbd_vfs_stream_write (CVE-2024-56626) and an OOB read in ksmbd_vfs_stream_read (CVE-2024-56627). In all three advisories, F5 states there is no impact to F5 products (either not affected or previously resolved) and provides no customer action beyond standard kernel patching practices in affected environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
F5 issued product advisories for Linux kernel vulnerabilities CVE-2024-56615, CVE-2024-56626, and CVE-2024-56627. The references provide no additional technical details or earlier event dates beyond the advisory publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcemy.f5.com
Open sourcemy.f5.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 published product advisories covering two separate upstream security flaws affecting widely used core components: **Linux kernel** vulnerability `CVE-2025-40154` and **OpenSSL** vulnerability `CVE-2025-68160`. The notices indicate vendor tracking and assessment activity for vulnerabilities in foundational software commonly embedded in network, application delivery, and security appliances. The advisories were released through F5's product advisory channel under knowledge base articles `K000160420` and `K000160552`. While the referenced notices provide limited public synopsis text, the combined updates show F5 alerting customers to potential product impact from both an operating system kernel issue and a cryptographic library flaw, signaling the need for customers to review affected-product guidance and remediation information as it becomes available.
Jun 29, 2026
A use-after-free vulnerability identified as CVE-2025-21887 was discovered in the Linux kernel's OverlayFS implementation, specifically involving improper handling of the `dput()` operation in `ovl_dentry_update_reval`. This flaw could potentially allow local attackers to exploit the kernel, but F5 has confirmed that none of its products are affected by this vulnerability. The issue has been resolved in the upstream Linux kernel, and vendors have begun evaluating and addressing the impact on their respective products. Red Hat and Ubuntu have both issued security advisories urging users and administrators to apply updates to address vulnerabilities in the Linux kernel across multiple supported versions and platforms. These advisories are part of a coordinated response to recent kernel vulnerabilities, including CVE-2025-21887, ensuring that enterprise and cloud environments remain protected. Organizations are encouraged to review vendor-specific guidance and implement the recommended patches to mitigate potential risks associated with this kernel flaw.
Jun 29, 2026
Microsoft added several CVEs to its Security Update Guide for Linux kernel components, including **CVE-2026-31609** in SMB, **CVE-2026-31591** in KVM SEV/SNP handling, **CVE-2026-31469** in `virtio_net`, **CVE-2026-31525** in BPF, and **CVE-2026-31494** in the `macb` network driver. The listed issues span memory-safety and logic flaws such as a double-free in `smbd_free_send_io()` after `smbd_send_batch_flush()`, a use-after-free in `virtio_net`, and undefined behavior in the BPF interpreter for signed division and modulo involving `INT_MIN`. The disclosures also include a KVM fix that locks all vCPUs while synchronizing VMSAs during SEV-SNP launch completion, indicating impact in confidential computing and virtualization workflows, alongside a `macb` driver correction for queue statistics handling. Taken together, the entries show Microsoft tracking upstream Linux kernel vulnerabilities across file sharing, virtualization, packet processing, and network drivers, with several bugs carrying potential stability or security impact in environments running affected kernel code paths.
Jul 3, 2026