Loading story…
CVE-2022-1882 is a use-after-free flaw in the Linux kernel's pipe notification and watch-queue functionality. A race between post_one_notification() and free_pipe_info() can leave watch_queue->pipe pointing to freed memory, allowing a local authenticated attacker to crash the host or potentially elevate privileges. The vulnerability was introduced by commit db8facfc9fafacefe8a835 and requires a difficult-to-win race condition; Red Hat rated it Moderate (CVSS 7.0), while NVD assigned CVSS 7.8.
Upstream Linux fixed the issue before kernel 5.18 final, with the remediation included in Fedora stable kernel 5.18.15. The patch serializes access to watch queues and their destruction state through new locking helpers, preventing notification paths from accessing invalid pipes or defunct queues. Red Hat remediated affected Red Hat Enterprise Linux 9 kernel and kernel-rt packages through RHSA-2023:2148 and RHSA-2023:2458; listed RHEL 6, 7, and 8 kernel variants were not affected.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2148 and RHSA-2023:2458 to fix CVE-2022-1882 in Red Hat Enterprise Linux 9 kernel and kernel-rt packages, and closed its tracking bug.
The Linux kernel pipe use-after-free vulnerability CVE-2022-1882 was reported. The flaw leaves a watch_queue pipe reference dangling after free_pipe_info() frees the pipe, enabling later access by post_one_notification().
Fedora incorporated the fix for CVE-2022-1882 into its stable Linux kernel 5.18.15 updates.
Linux upstream fixed CVE-2022-1882 in kernel version 5.18-rc8 with changes that serialize access to watch queues and their defunct state, ensuring notification pipes remain valid while accessed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-2959** is a Linux kernel race condition in the watch queue implementation that can allow a local, low-privileged attacker to escalate privileges or cause a denial of service. Missing synchronization in `pipe_resize_ring()` permits a process resizing a watch-queue pipe through `ioctl(IOC_WATCH_QUEUE_SET_SIZE)` to race with a `keyctl()`-triggered notification, resulting in access to a freed buffer. The flaw is categorized as **CWE-820: Missing Synchronization**, in which concurrent unsynchronized access to shared resources can produce an unexpected state and enable data disclosure, modification, or altered execution logic. Red Hat assigned CVSS 3.1 7.0 (`AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`); RHEL 6–8 are unaffected because they lack general notification queue support, while fixes were issued for affected RHEL 9 `kernel`, `kernel-rt`, and `kpatch-patch` packages.
Aug 26, 2026
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
A use-after-free flaw in the Linux kernel's Netfilter nftables `nft_pipapo_walk` function, tracked as **CVE-2023-6817**, can allow a local attacker with `CAP_NET_ADMIN` to crash a host, disclose information, or elevate privileges. The defect allowed inactive PIPAPO set elements to be processed and deactivated twice during a set walk, leading to a kernel crash; it carries a CVSS v3.1 score of 7.8. Linux kernel commit `317eb9685095678f2c9f5a8189de698c5354316a` fixes the issue by verifying that an element is active before invoking the iterator callback. Red Hat issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; systems with unprivileged user namespaces enabled may let unprivileged users obtain the required capability. OpenShift Container Platform inherits the affected code through RHCOS, but Red Hat rates impact as Low because its namespace model prevents containers from acquiring the capabilities needed to exploit the flaw.
Aug 26, 2026