Loading story…
CVE-2022-20141 is a use-after-free flaw in the Linux kernel IPv4 IGMP implementation, in ip_check_mc_rcu within net/ipv4/igmp.c. Improper locking allows a local low-privileged user to race repeated opening and closing of IGMP inet sockets, potentially causing a kernel crash or escalating privileges; Android tracked the issue as A-112551163.
Red Hat rated the vulnerability Moderate with a CVSS v3.1 score of 7.0, noting that reliable exploitation has high complexity and that no reproducer was known. Fixes were released for Red Hat Enterprise Linux 8 and 9, including real-time kernel packages, and Fedora incorporated fixes in stable kernel 5.13.16 updates; RHEL 6 was not affected and RHEL 7 was outside support scope.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2736 for the RHEL 8 real-time kernel and RHSA-2023:2951 for the RHEL 8 kernel to fix CVE-2022-20141. Red Hat also closed Bug 2114937, its tracking issue for the vulnerability.
Red Hat released RHSA-2023:2148 for the RHEL 9 real-time kernel and RHSA-2023:2458 for the RHEL 9 kernel, addressing CVE-2022-20141.
Red Hat was notified of the Linux kernel IGMP use-after-free vulnerability affecting ip_check_mc_rcu.
CVE-2022-20141 was published for an Android kernel use-after-free in igmp.c's ip_check_mc_rcu function. The improper-locking flaw can be triggered locally by opening and closing inet sockets and may enable privilege escalation.
Fedora addressed CVE-2022-20141 in stable Linux kernel 5.13.16 updates.
RHSA-2024:0412 delivered a CVE-2022-20141 fix for the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel package.
David S. Miller committed Linux kernel patch 23d2b94043ca8835bd1e67749020e839f396a1c2, authored by Liu Jian, to lock the multicast source list during ip_check_mc_rcu traversal. The change prevents concurrent ip_mc_del_src deletion from causing a use-after-free in IPv4 IGMP source filtering.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
**CVE-2024-26804** is a use-after-free flaw in the Linux kernel's IPv4 `ip_tunnel` infrastructure that allows a low-privileged local user to crash an affected system. Recursive GRE or IPIP tunnel routing can cause a tunnel device's `needed_headroom` to increase indefinitely; after the packet buffer headroom exceeds 64 KiB, the 16-bit `skb->network_header` field can wrap, resulting in an out-of-bounds packet-buffer adjustment and use-after-free condition. The issue has existed since kernel version 2.6.34 and is fixed in stable releases 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, and 6.8 or later. Red Hat rates the issue as moderate severity with CVSS 5.5 and has issued updates for affected RHEL 8 and 9 streams; RHEL 6 is unsupported and should be considered affected. Organizations should deploy vendor kernel updates or move to a current stable kernel release rather than cherry-picking the individual patch.
Aug 26, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026