Loading story…
A flaw tracked as CVE-2026-23455 was disclosed in the Linux kernel's netfilter subsystem, affecting the nf_conntrack_h323 module used for H.323 connection tracking. In the DecodeQ931() path, a zero-length value can trigger an integer underflow and wraparound, leading to an out-of-bounds read in net/netfilter/nf_conntrack_h323_asn1.c. The bug can cause denial of service and may expose sensitive information; Red Hat rated it Moderate with a CVSS v3 score of 7.1, while cve.org published a higher 9.1 vector based on different exploitability assumptions.
The Linux kernel CVE team said the vulnerable code dates back to kernel 2.6.17 and reported fixes in multiple upstream stable branches, including 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5. Red Hat later shipped remediation through security errata for several Red Hat Enterprise Linux releases and included the flaw in RHSA-2026:35844, an Important kernel update for RHEL 7 Extended Lifecycle Support on x86_64, s390x, ppc64, and ppc64le; the advisory updates systems to kernel 3.10.0-1160.154.1.el7 and requires a reboot after installation.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:35844, an Important kernel security advisory for Red Hat Enterprise Linux 7 Extended Lifecycle Support, fixing CVE-2026-23455 along with three other kernel vulnerabilities. The advisory updated the kernel to version 3.10.0-1160.154.1.el7 and required a reboot after installation.
Red Hat released security errata fixing CVE-2026-23455 for RHEL 10 and RHEL 8 kernel packages, including RHSA-2026:21557, RHSA-2026:21745, and RHSA-2026:21706. These advisories addressed the nf_conntrack_h323 zero-length handling flaw in affected kernel builds.
Red Hat published its CVE entry for CVE-2026-23455, describing the Linux kernel netfilter nf_conntrack_h323 flaw as a Moderate-severity out-of-bounds read that could cause denial of service or disclose sensitive information. Red Hat assigned the issue a CVSS v3 score of 7.1.
The Linux kernel CVE team assigned CVE-2026-23455 to the nf_conntrack_h323 DecodeQ931() out-of-bounds read vulnerability. The announcement also identified fixes across multiple stable and release candidate kernel branches.
The Linux kernel CVE announcement states the out-of-bounds read flaw in netfilter's nf_conntrack_h323 component was introduced in Linux kernel 2.6.17. The bug stems from DecodeQ931() decrementing a zero length value and passing the wrapped result onward.
Red Hat released RHSA-2026:55445 to fix CVE-2026-23455 in Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages. This extended the fix to the RHEL 10.0 EUS stream.
Red Hat released RHSA-2026:41236 to fix CVE-2026-23455 in Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt packages. This added remediation for the real-time kernel variant.
Red Hat released RHSA-2026:35896 to fix CVE-2026-23455 in RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages. The erratum extended coverage to affected 8.4 streams.
Red Hat released RHSA-2026:33899 to fix CVE-2026-23455 in RHEL 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages. The advisory covered affected 8.6 update streams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026
Red Hat addressed **CVE-2023-35001**, a high-severity out-of-bounds memory-access vulnerability in the Linux kernel Netfilter `nf_tables` implementation, specifically the `nft_byteorder_eval()` function. Failed bounds checking and incorrect data alignment can allow an attacker holding `CAP_NET_ADMIN` in a user or network namespace to escalate privileges locally; Red Hat assigned a CVSS v3.1 score of 7.8, with high impacts to confidentiality, integrity, and availability. Affected Red Hat Enterprise Linux 7 and 8 kernel, real-time kernel, and kpatch packages received fixes through 2023 advisories. RHSA-2023:7243 supplies fixed `3.10.0-1062.80.1.el7` kernel packages for RHEL 7.7 AUS on x86_64; organizations must reboot after installation. Until updates can be deployed, Red Hat recommends blacklisting the affected Netfilter kernel module to prevent it from loading.
Aug 26, 2026
A **use-after-free** flaw in the Linux kernel traffic control `act_ct` path, tracked as **CVE-2026-23270**, was disclosed after maintainers found that incorrect binding to non-ingress egress qdiscs could leave the defragmentation engine holding an `skb` that had already been treated as consumed. The bug affects the `net/sched` subsystem and can let a local user with the required privileges trigger a kernel crash, causing **denial of service**, and in some cases potentially achieve **privilege escalation**. Upstream kernel maintainers fixed the issue by restricting `act_ct` so it can bind only to `clsact`/ingress qdiscs and shared blocks, while still allowing egress attachment only through `clsact`. The Linux kernel CVE team said the flaw was introduced in kernel branches starting with **6.8** and selected stable backports, with fixes released in **6.12.77**, **6.18.18**, **6.19.8**, and **7.0-rc3**. Red Hat rated the issue **Moderate** and noted that exploitation depends on a specific misconfiguration, but still shipped fixes across multiple **RHEL 8, 9, and 10** kernel packages through security errata, including **RHSA-2026:13566** for RHEL 10. That advisory bundled CVE-2026-23270 with other kernel fixes and instructed customers to install updated kernel packages and **reboot affected systems** after applying the update.
Aug 25, 2026