Loading story…
A flaw in the Linux kernel's netfilter xt_tcpmss module, tracked as CVE-2026-43190, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the tcpmss match.
The Linux kernel CVE team published fixes across multiple stable branches, including 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in RHSA-2026:44694 for Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages, alongside fixes for CVE-2026-31684 and CVE-2026-46152; updated packages include kernel version 6.12.0-55.92.1.el10_0 for x86_64, s390x, ppc64le, and aarch64, and Red Hat said affected systems should be rebooted after installation.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-23, Red Hat published RHSA-2026:44694 for Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages, including a fix for CVE-2026-43190 alongside CVE-2026-31684 and CVE-2026-46152. The advisory rated the update Important, assessed the security impact as Moderate, and required a reboot after installation.
On 2026-05-28, Red Hat released fixes for CVE-2026-43190 in Red Hat Enterprise Linux 8 kernel, RHEL 8 kernel-rt, and RHEL 10 kernel through security errata including RHSA-2026:21706, RHSA-2026:21745, and RHSA-2026:21557. These were the first Red Hat product fixes listed for the vulnerability.
Red Hat published its CVE entry for CVE-2026-43190 on 2026-05-06, describing a remotely triggerable one-byte out-of-bounds read in the Linux kernel's netfilter xt_tcpmss module. Red Hat rated the issue Moderate, assigned a CVSS v3 score of 7.5, and said no mitigation meeting its Product Security criteria was available.
The Linux kernel CVE announcement stated the flaw had been fixed in stable releases 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0. The advisory tied each fixed version to a corresponding upstream commit.
On 2026-05-06, the Linux kernel CVE team announced CVE-2026-43190 for an out-of-bounds read in netfilter's xt_tcpmss code caused by reading the TCP option length without validating remaining data. The notice identified affected code in net/netfilter/xt_tcpmss.c and advised users to update to stable kernels rather than cherry-pick commits.
On 2026-07-17, Red Hat issued RHSA-2026:41236 to fix CVE-2026-43190 in Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt packages.
Red Hat last modified its CVE-2026-43190 entry on 2026-07-01. The update reflected the vendor's ongoing tracking of affected products and fixes.
On 2026-06-22, Red Hat fixed CVE-2026-43190 in Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel packages via RHSA-2026:27729.
On 2026-06-17, Red Hat issued RHSA-2026:26535 to fix CVE-2026-43190 in Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and 8.4 Extended Update Support Long-Life Add-On kernel packages.
On 2026-06-12, Red Hat fixed CVE-2026-43190 for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On kernel packages via RHSA-2026:25533.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw tracked as **CVE-2026-23455** was disclosed in the Linux kernel's `netfilter` subsystem, affecting the `nf_conntrack_h323` module used for H.323 connection tracking. In the `DecodeQ931()` path, a zero-length value can trigger an integer underflow and wraparound, leading to an out-of-bounds read in `net/netfilter/nf_conntrack_h323_asn1.c`. The bug can cause denial of service and may expose sensitive information; Red Hat rated it **Moderate** with a CVSS v3 score of **7.1**, while `cve.org` published a higher **9.1** vector based on different exploitability assumptions. The Linux kernel CVE team said the vulnerable code dates back to kernel **2.6.17** and reported fixes in multiple upstream stable branches, including **6.1.167**, **6.6.130**, **6.12.78**, **6.18.20**, **6.19.10**, and **7.0-rc5**. Red Hat later shipped remediation through security errata for several Red Hat Enterprise Linux releases and included the flaw in **RHSA-2026:35844**, an **Important** kernel update for **RHEL 7 Extended Lifecycle Support** on `x86_64`, `s390x`, `ppc64`, and `ppc64le`; the advisory updates systems to kernel **3.10.0-1160.154.1.el7** and requires a reboot after installation.
Aug 25, 2026
Red Hat released **RHSA-2026:21557**, an Important security update for the Linux kernel in **Red Hat Enterprise Linux 10** and related channels, addressing **18 vulnerabilities** across subsystems including CAN J1939, IMA, memory management, netfilter, conntrack, `io_uring`, Bluetooth, HID, Wi-Fi, XFS, and `dpaa2-switch`. The advisory applies to multiple RHEL 10 variants on `x86_64`, `ARM64`, IBM z Systems, and Power little endian, including Extended Update Support and Extended Life Cycle offerings, and Red Hat said affected systems must be **rebooted** after patching for the fixes to take effect. Among the flaws covered were **CVE-2026-31684**, a network scheduler bug triggered by specially crafted packets with nested VLAN headers that can cause an out-of-bounds read and system crash, and **CVE-2026-43027**, a netfilter `nf_conntrack_helper` cleanup flaw that can lead to a use-after-free condition, enabling denial of service and potentially privilege escalation. Red Hat rated both issues **moderate severity** with CVSS v3 scores of **7.1**, and said fixes were issued across multiple RHEL kernel package streams, including RHEL 7, 8, and 10 for the VLAN-related flaw and additional errata for the conntrack issue.
Aug 25, 2026
Red Hat released **RHSA-2025:21931** kernel updates for Red Hat Enterprise Linux 10 that remediate `CVE-2025-39955`, a TCP Fast Open (TFO) state-management flaw. The vulnerability occurs when a server-side TFO socket is reused as a client before its prior TFO operation completes, potentially leaving `tcp_sk(sk)->fastopen_rsk` referencing a freed `request_sock`; a retransmission timer may then access the stale object, causing a kernel warning and potentially enabling use-after-free or information-disclosure conditions. Red Hat rates the issue Moderate severity with a CVSS v3.1 score of 7.6 and notes that exploitation requires local access and the ability to create and manipulate TFO sockets, typically in privileged or test environments. The advisory updates RHEL 10 kernels for x86_64, s390x, ppc64le, and aarch64, including applicable extended-support variants; it also fixes the NFS filehandle bounds-checking vulnerability `CVE-2025-39730`. Organizations should apply the updated kernel packages and reboot affected hosts.
Aug 25, 2026