Loading story…
CVE-2022-2663 is a moderate-severity flaw in the Linux kernel’s nf_conntrack_irc Netfilter connection-tracking helper. An attacker can send malformed or ambiguous unencrypted IRC traffic that causes incorrect matching of IRC messages, potentially bypassing firewall controls when the helper is enabled. Red Hat rates the issue CVSS 3.1 5.3 and classifies it as CWE-923.
The upstream fix tightens CTCP DCC detection so it is accepted only at the beginning of an IRC message, and corrects forged-IP validation for NATed DCC connections, including rejection of port 0. Fedora addressed the flaw in Linux kernel 5.19.9 stable updates, while Red Hat issued fixes for supported RHEL 8, RHEL 8.6 EUS, and RHEL 9 kernel packages. Organizations unable to patch should prevent the nf_conntrack_irc module from loading; exposure is limited to systems using unencrypted IRC with this helper configured.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2736 for RHEL 8 kernel-rt and RHSA-2023:2951 for the RHEL 8 kernel. It also closed Bugzilla issue 2123056, directing users to product-specific CVE-page updates.
Red Hat issued RHSA-2023:2148 for the RHEL 9 kernel-rt and RHSA-2023:2458 for the RHEL 9 kernel to address CVE-2022-2663.
A September update reported that Fedora had received a fix for CVE-2022-2663 through Linux kernel 5.19.9 stable updates.
Pedro Sampaio reported Red Hat Bugzilla issue 2123056 for CVE-2022-2663, covering confused IRC message handling in nf_conntrack_irc that could permit firewall-policy bypasses.
David Leadbeater submitted a two-patch series for Linux's nf_conntrack_irc helper. The changes tightened DCC-message matching and corrected forged-IP validation for NATed IRC DCC traffic.
RHSA-2024:0724 addressed CVE-2022-2663 in the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel.
Pablo Neira Ayuso applied the nf_conntrack_irc patch correcting forged-IP validation for NATed IRC DCC traffic, including rejecting port 0 as forged.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026
A flaw tracked as **CVE-2026-23455** was disclosed in the Linux kernel's `netfilter` subsystem, affecting the `nf_conntrack_h323` module used for H.323 connection tracking. In the `DecodeQ931()` path, a zero-length value can trigger an integer underflow and wraparound, leading to an out-of-bounds read in `net/netfilter/nf_conntrack_h323_asn1.c`. The bug can cause denial of service and may expose sensitive information; Red Hat rated it **Moderate** with a CVSS v3 score of **7.1**, while `cve.org` published a higher **9.1** vector based on different exploitability assumptions. The Linux kernel CVE team said the vulnerable code dates back to kernel **2.6.17** and reported fixes in multiple upstream stable branches, including **6.1.167**, **6.6.130**, **6.12.78**, **6.18.20**, **6.19.10**, and **7.0-rc5**. Red Hat later shipped remediation through security errata for several Red Hat Enterprise Linux releases and included the flaw in **RHSA-2026:35844**, an **Important** kernel update for **RHEL 7 Extended Lifecycle Support** on `x86_64`, `s390x`, `ppc64`, and `ppc64le`; the advisory updates systems to kernel **3.10.0-1160.154.1.el7** and requires a reboot after installation.
Aug 25, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026