Loading story…
Red Hat addressed CVE-2023-1206, a moderate-severity Linux kernel flaw that lets an attacker create hash collisions in the IPv6 connection lookup table using a modified IPv6 SYN-flood technique. A network-adjacent low-privileged attacker—or an attacker with sufficient bandwidth—can sharply increase connection-lookup costs and drive CPU utilization on servers accepting IPv6 connections to roughly 95%, causing denial of service. Red Hat rates the issue CVSS 5.7; it affects availability but not confidentiality or integrity.
Fixes were released for supported RHEL 8 and RHEL 9 kernel variants, relevant Extended Update Support releases, and Red Hat Virtualization 4 on RHEL 8. RHSA-2023:5603 updates RHEL 9.0 EUS for SAP Solutions kernel-rt to 5.14.0-70.75.1.rt21.146.el9_0; affected systems require a reboot after installation. RHEL 6 and RHEL 7 kernel packages are outside support scope and should be treated as affected.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:6583 to remediate CVE-2023-1206 in the RHEL 9 kernel.
Red Hat released RHSA-2023:5603 and RHSA-2023:5604 for RHEL 9.0 Extended Update Support, and RHSA-2023:5627 for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHSA-2023:5603 updated the RHEL 9.0 EUS kernel-rt package to version 5.14.0-70.75.1.rt21.146.el9_0 and also addressed seven other kernel vulnerabilities.
Red Hat released RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, addressing CVE-2023-1206.
Fedora remediated the IPv6 connection-lookup hash-collision vulnerability through its 6.4.8 stable kernel updates.
A fix for CVE-2023-1206 was merged into Linux net.git as commit d11b0df7ddf1831f3e170972f43186dad520bfcc and was expected in Linux 6.5-rc4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
A flaw in the Linux kernel's netfilter `ip6t_eui64` component, tracked as **CVE-2026-31685**, allowed specially crafted IPv6 packets to trigger access to an invalid MAC header and potentially crash vulnerable systems. The bug was in `eui64_mt6()`, where the code could still call `eth_hdr(skb)` when the packet's MAC header was invalid if the fragment offset was zero, creating a remote denial-of-service condition during IPv6 packet processing. The issue affected code dating back to Linux kernel **2.6.12** and was fixed by rejecting invalid MAC headers for all packets before Ethernet header access. Upstream fixes were released across several stable kernel branches, including **6.12.83**, **6.18.24**, **6.19.14**, and **7.0**, while Red Hat shipped patches through security errata for multiple **RHEL 7, 8, 9, and 10** product variants. Red Hat rated the flaw **Moderate** with a **CVSS 7.1** for its products, although **cve.org** listed a **9.4** score, and both upstream and vendor guidance advised updating to the latest supported kernel packages.
Aug 25, 2026
Red Hat released Important kernel updates to fix **CVE-2026-74581**, a use-after-free flaw in the Linux IPv6 FIB rule lookup path. In `fib6_rule_suppress`, a stale `res->rt6` pointer can be returned after its associated `rt6_info` route object has been freed and later released again, creating a potential kernel crash or privilege-escalation condition. Exploitation requires the ability to configure IPv6 routing or FIB rules; the issue is classified as **CWE-416**. The remediation is included in RHEL 9 kernel updates, including RHSA-2026:59723 and applicable kernel-rt updates, and in selected RHEL 8.4 AUS and Extended Life Cycle/Long-Life support channels through advisories including RHSA-2026:59994 and RHSA-2026:60485. Administrators should update affected kernel packages and reboot to activate the fix. Blacklisting IPv6 modules does not mitigate affected kernels with IPv6 built in; organizations that do not require IPv6 can consider disabling it through kernel command-line configuration. Related Oracle Linux and AlmaLinux 9 kernel updates also incorporate the broader RHEL 9 kernel fixes; available notices reported no known public exploits.
Sep 1, 2026