Loading story…
CVE-2022-3566 is a race condition in the Linux kernel TCP subsystem involving concurrent access to icsk->icsk_af_ops. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1.
Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2951 for RHEL 8 kernel packages and RHSA-2023:2736 for RHEL 8 kernel-rt packages to fix CVE-2022-3566.
Red Hat released RHSA-2023:2458 for RHEL 9 kernel packages and RHSA-2023:2148 for RHEL 9 kernel-rt packages to address CVE-2022-3566.
Red Hat released RHSA-2024:0724 with fixed kernel packages for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
CVE-2022-3566 was identified in the Linux kernel TCP subsystem as a CWE-366 data race involving access to icsk->icsk_af_ops on a do_ipv6_setsockopt-related code path. Exploitation by a low-privileged adjacent-network attacker could disclose kernel or IP information and affect confidentiality, integrity, and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
Red Hat addressed **CVE-2020-36516**, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel `5.17-rc2`. The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through **RHSA-2024:2674** for RHEL 8.6 extended-support channels. That advisory also remediates `CVE-2024-26586` in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
Aug 26, 2026
**CVE-2023-33951** is a moderate-severity race condition in the Linux kernel’s `vmwgfx` driver affecting its handling of GEM objects. Improper locking can allow a local, highly privileged attacker to disclose kernel-context information, with Red Hat also assessing a low availability impact. Red Hat assigned a CVSS v3.1 score of 6.7; NVD scored it 5.3, reflecting a higher assessed attack complexity. Red Hat released fixes through errata for affected Red Hat Enterprise Linux 8 and 9 kernel package streams between November 2023 and July 2024. RHEL 9 `kernel-rt` remains listed as affected. Organizations should apply the relevant kernel updates and, where patching is not immediately possible, prevent the `vmwgfx` kernel module from loading.
Aug 26, 2026