Loading story…
A race condition in the Linux kernel IPv6 networking stack, tracked as CVE-2022-3524, can allow a local low-privileged user to crash an affected system. The flaw occurs when IPV6_ADDRFORM converts a socket from IPv6 to IPv4 while another operation processes IPV6_DSTOPTS, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue CVSS 5.5 (Moderate); confidentiality and integrity are unaffected, but availability impact is high.
The upstream kernel fix hardens access to sk->sk_prot by replacing direct reads with READ_ONCE() in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing WRITE_ONCE() used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2736 for the RHEL 8 kernel-rt package and RHSA-2023:2951 for the RHEL 8 kernel package to fix CVE-2022-3524.
Red Hat released RHSA-2023:2458 for the RHEL 9 kernel and RHSA-2023:2148 for the RHEL 9 kernel-rt package, addressing CVE-2022-3524.
The Linux kernel stable tree released a patch replacing direct reads of the sk_prot protocol-handler pointer with READ_ONCE() to mitigate races when IPV6_ADDRFORM converts IPv6 sockets to IPv4 during concurrent socket operations.
RHSA-2024:0724 was released to address CVE-2022-3524 in the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 for RHEL 8 kernel.
Fedora remediated CVE-2022-3524 through its Linux 6.0.7 stable kernel updates. The vulnerability affects ipv6_renew_options() and can cause a memory leak when IPV6_ADDRFORM is used locally.
Linux commit 3c52c6bb831f fixed a race between IPV6_ADDRFORM socket conversion and concurrent IPv6 socket-option operations that could leave allocated IPv6 option memory unfreed. The patch stops IPv6 option processing when the socket family has changed from AF_INET6 after acquiring the socket lock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026
**CVE-2022-3623** is a moderate-severity Linux kernel flaw in `follow_page_pte` within `mm/gup.c`. A race condition can poison a page-table entry, enabling a local, low-privileged attacker to trigger denial of service. The defect is classified as **CWE-123** (write-what-where condition), a memory-corruption weakness that can permit arbitrary memory modification and, in some cases, code execution or privilege escalation. The issue was fixed upstream in Linux 6.1-rc1. Red Hat released corrected `kernel` and `kernel-rt` packages for affected RHEL 8 and RHEL 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and RHEL 7 kernel variants were not affected. Red Hat assigned CVSS 3.1 score **5.8** and stated that no qualifying mitigation was available, making deployment of vendor updates the recommended remediation.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026