Loading story…
CVE-2022-3623 is a moderate-severity Linux kernel flaw in follow_page_pte within mm/gup.c. A race condition can poison a page-table entry, enabling a local, low-privileged attacker to trigger denial of service. The defect is classified as CWE-123 (write-what-where condition), a memory-corruption weakness that can permit arbitrary memory modification and, in some cases, code execution or privilege escalation.
The issue was fixed upstream in Linux 6.1-rc1. Red Hat released corrected kernel and kernel-rt packages for affected RHEL 8 and RHEL 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and RHEL 7 kernel variants were not affected. Red Hat assigned CVSS 3.1 score 5.8 and stated that no qualifying mitigation was available, making deployment of vendor updates the recommended remediation.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2148 for RHEL 9 kernel-rt and RHSA-2023:2458 for the RHEL 9 kernel to address CVE-2022-3623.
Rohit Keshri reported Red Hat bug 2165721 for CVE-2022-3623, a race condition in Linux kernel follow_page_pte that can poison a page-table entry and cause denial of service.
RHSA-2024:0724 addressed CVE-2022-3623 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat released RHSA-2023:2736 for RHEL 8 kernel-rt and RHSA-2023:2951 for the RHEL 8 kernel, and closed bug 2165721 for CVE-2022-3623.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026