Loading story…
Researchers disclosed five flaws in the Linux kernel's cfg80211 and mac80211 Wi-Fi stack that can be triggered by malicious wireless frames. CVE-2022-41674, CVE-2022-42719, and CVE-2022-42720 were assessed as potentially permitting remote code execution; CVE-2022-42721 and CVE-2022-42722 can cause denial of service. The latter issues stem from list corruption in cfg80211_add_nontrans_list and erroneous P2P-Device beacon-protection handling in ieee80211_rx_h_decrypt; Red Hat also reports that CVE-2022-41674 can crash affected systems or expose kernel information through an integer overflow in Wi-Fi scan handling.
Red Hat released corrected kernel and kernel-rt packages for affected RHEL 8 and 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and 7 variants are listed as unaffected. Organizations should prioritize installation of the applicable kernel advisories on systems using Wi-Fi hardware, particularly where attackers can operate within radio range. Where immediate patching is not possible, Red Hat recommends preventing the mac80211 module from loading to mitigate CVE-2022-42722; no qualifying mitigation is available for CVE-2022-41674 or CVE-2022-42721.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2736 and RHSA-2023:2951 for affected RHEL 8 kernel and kernel-rt packages, fixing CVE-2022-41674, CVE-2022-42721, and CVE-2022-42722. Red Hat also closed Bug 2134517, its tracking record for CVE-2022-42722.
Red Hat issued RHSA-2023:2148 and RHSA-2023:2458 to fix CVE-2022-41674, CVE-2022-42721, and CVE-2022-42722 in affected RHEL 9 kernel and kernel-rt packages.
Rohit Keshri reported the beacon-protection flaw affecting Wi-Fi P2P Device interfaces, which can dereference a missing netdev pointer and cause a kernel denial of service. Red Hat tracked the issue as Bug 2134517.
SUSE disclosed five Linux WLAN-stack flaws after Soenke Huster and Intel's Johannes Berg investigated an over-the-air mac80211 buffer-overwrite issue. CVE-2022-41674, CVE-2022-42719, and CVE-2022-42720 were assessed as potentially enabling remote code execution, while CVE-2022-42721 and CVE-2022-42722 could cause denial of service; a patch set was submitted for Linux netdev review.
Red Hat closed the tracking bugs for CVE-2020-24587, CVE-2020-24588, and CVE-2020-26139 after recording upstream, Fedora, and RHEL remediation information.
Wade Mealing reported Red Hat bugs for CVE-2020-24587, CVE-2020-24588, and CVE-2020-26139. The flaws respectively involved mixed-key fragment reassembly, Wi-Fi payload parsing as Layer 2 frames, and forwarding EAPOL frames from unauthenticated clients.
Johannes Berg submitted an 18-patch mac80211 and ath10k/ath11k security-fix series addressing Linux cases of 12 Wi-Fi flaws identified by Mathy Vanhoef, including fragment-reassembly, encryption-validation, A-MSDU, and EAPOL-forwarding issues. The affected CVEs included CVE-2020-24586 through CVE-2020-24588 and CVE-2020-26139 through CVE-2020-26147.
RHSA-2024:1188 fixed CVE-2022-41674, CVE-2022-42721, and CVE-2022-42722 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Fedora shipped fixes in its stable Linux 5.12.9 kernel updates for CVE-2020-24587, CVE-2020-24588, CVE-2020-26139, CVE-2020-26144, and CVE-2020-26146.
Red Hat addressed CVE-2020-24586, CVE-2020-24587, CVE-2020-24588, CVE-2020-26139, CVE-2020-26144, and CVE-2020-26146 for Red Hat Enterprise Linux 8 through RHSA-2021:4140 and RHSA-2021:4356.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel updates for **RHEL 9** and **RHEL 10** addressing several locally exploitable Linux kernel flaws, including `CVE-2025-21647` in the `sch_cake` traffic-control scheduler. An underflow in per-host bulk-flow fairness counters could lead to an out-of-bounds read, potentially exposing kernel memory or crashing the system; Red Hat assigned it a CVSS 3.1 score of 7.1. The upstream correction adds centralized bounds checking for counter access. The updates also remediate denial-of-service issues in the mt76 `mt7925` Wi-Fi driver (`CVE-2024-57989`), HID core (`CVE-2024-57986`), IDPF driver (`CVE-2024-58057`), and Realtek Bluetooth setup path (`CVE-2024-57987`). These flaws can trigger NULL-pointer dereferences, CPU-workqueue starvation, or system crashes under local attack conditions. RHEL 9 `kernel-rt` remains affected or will not fix for several listed issues; organizations should apply the applicable kernel errata and reboot systems to activate the patched kernel.
Aug 26, 2026
Red Hat released Moderate-severity RHEL 8 kernel updates `4.18.0-348.el8` and real-time kernel updates `4.18.0-348.rt7.130.el8` to remediate numerous Linux kernel vulnerabilities across eBPF, networking, Bluetooth, filesystems, device drivers, memory handling, and wireless components. The advisories affect standard RHEL 8 deployments across x86_64, ARM64, IBM Z, and Power little-endian, as well as RHEL for Real Time, Real Time for NFV, related telecommunications editions, and specified x86_64 Extended Life Cycle offerings. Among the fixed issues is `CVE-2020-36158`, a buffer overflow in the Marvell `mwifiex` Wi-Fi driver’s `mwifiex_cmd_802_11_ad_hoc_start` function. A sufficiently privileged local attacker could trigger the flaw with an overly long SSID while creating an ad-hoc wireless network, potentially achieving arbitrary code execution; affected upstream kernels extend through version 5.10.4. Organizations should apply RHSA-2021:4356 or RHSA-2021:4140 as applicable and reboot systems to activate the patched kernel; blacklisting the `mwifiex` module is a mitigation where immediate patching is not possible.
Aug 28, 2026
**CVE-2023-52800** is a low-severity use-after-free vulnerability in the Linux kernel's `ath11k` Wi-Fi driver. In HTTP packet-log handling within `drivers/net/wireless/ath/ath11k/dp_rx.c`, code accessed RCU-protected active physical-device data through `ath11k_mac_get_ar_by_pdev_id()` without an RCU read-side critical section. The flaw, introduced in kernel 5.6, requires local access and high privileges; Red Hat assigned CVSS 4.4, citing potential availability impact with no confidentiality or integrity impact. Upstream fixes are available in Linux 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, 6.7, and later stable releases, and maintainers recommend updating to a current stable kernel rather than cherry-picking the patch. Red Hat remediated affected Red Hat Enterprise Linux 8 kernels through **RHSA-2024:7000**; RHEL 6 and 7 were assessed as not affected, while fixes for RHEL 8 `kernel-rt` and RHEL 9 kernel variants were deferred.
Aug 26, 2026