Loading story…
CVE-2023-45871 is an Important-rated buffer overflow in the Linux kernel’s Intel IGB Ethernet driver. When rx-all/store-bad-packet behavior is enabled, an oversized physical-layer frame can overflow a receive-ring buffer in igb_configure_rx_ring, potentially compromising system confidentiality, integrity, and availability. Red Hat assigned the flaw a CVSS v3.1 score of 7.5; exploitation requires an adjacent-network attacker and is considered high complexity because it depends on oversized frames and a non-default configuration.
The upstream kernel fix updates igb_set_rx_buffer_len to allocate large receive buffers on systems with page sizes below 8192 bytes when either frames exceed IGB_MAX_FRAME_BUILD_SKB or the E1000_RCTL_SBP receive-control flag is set. Red Hat released corrected kernel, kernel-rt, and kpatch packages for affected Red Hat Enterprise Linux 7 and 8 streams in February and March 2024, with no qualifying mitigation listed at the time of its advisory.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:1332 to fix CVE-2023-45871 in the Red Hat Enterprise Linux 7 kernel-rt stream.
Red Hat released RHSA-2024:1323 to fix CVE-2023-45871 in the Red Hat Enterprise Linux 7 kpatch-patch stream.
Red Hat released RHSA-2024:1249 for the RHEL 7 kernel and RHSA-2024:1268 and RHSA-2024:1269 for the RHEL 8.2 Advanced Update Support kernel and 8.2 Telecommunications Update Service kernel-rt, addressing CVE-2023-45871.
Red Hat released RHSA-2024:0999 to fix CVE-2023-45871 in the Red Hat Enterprise Linux 7.7 Advanced Update Support kernel.
Red Hat released RHSA-2024:0980 to fix CVE-2023-45871 in the Red Hat Enterprise Linux 7.6 Advanced Update Support kernel.
Red Hat released fixes for CVE-2023-45871 in Red Hat Enterprise Linux 8 kernel, kernel-rt, and kpatch-patch streams through RHSA-2024:0897, RHSA-2024:0881, and RHSA-2024:0876.
The Linux stable tree updated the Intel igb driver so systems with page sizes below 8192 bytes select large receive buffers when the E1000_RCTL_SBP flag is enabled, in addition to oversized maximum-frame configurations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-39973** affects the Linux kernel’s Intel i40e Ethernet driver: a malicious virtual function can provide an oversized or misaligned `ring_len` value that is passed to a hardware memory context without adequate validation. The condition can create excessive transmit or receive queue lengths, potentially resulting in memory corruption or undefined behavior. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.5, while CVE.org assigns 8.8 under different environmental assumptions; RHEL 7 through 10, including applicable real-time kernels, are listed as affected, while RHEL 6 is not affected. The defect aligns with **CWE-131**, incorrect calculation of buffer size, a memory-safety weakness that can lead to out-of-bounds access, crashes, sensitive-data exposure, or code execution. Red Hat’s RHSA-2025:21469 provides updated RHEL 9 kernel packages for multiple kernel security issues and requires a reboot after installation; however, Red Hat’s CVE record separately reports no qualifying mitigation for CVE-2025-39973. Organizations should identify systems using affected i40e hardware and virtual-function configurations, apply applicable vendor kernel updates, reboot hosts, and restrict untrusted VF access where operationally possible.
Aug 25, 2026
**CVE-2024-52332** affects the Linux kernel's Intel `igb` Ethernet driver. When `pci_register_driver()` fails during `igb_init_module()`, the driver could leave `dca_notifier` registered; a subsequent notifier call could then access invalid memory after the driver installation has failed. The defect, present since kernel version 2.6.29, can cause a local denial of service. Upstream fixes are available in stable kernels 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.66, 6.12.5, and 6.13-rc2. Red Hat rated the flaw **Moderate** with CVSS 4.7, citing required local access, low privileges, high attack complexity, and high availability impact. Fixes were issued for standard kernels in RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095; RHEL 10 `kernel-rt` remains affected, while RHEL 9 `kernel-rt` is marked will not fix. Organizations should update to a current vendor-supported kernel release rather than backporting the isolated patch; where patching is not immediately feasible, Red Hat recommends preventing the `igb` module from loading, including by blacklisting it when operationally viable.
Aug 26, 2026
**CVE-2024-41009** is an out-of-bounds memory-access flaw in the Linux kernel BPF ring-buffer implementation. A privileged local attacker can manipulate the consumer position and the ring buffer's double-mapped circular layout to obtain overlapping record reservations, then alter an earlier record header so that `bpf_ringbuf_commit()` accesses an incorrect page, potentially crashing the kernel. The weakness is associated with CWE-121, stack-based buffer overflow, and affects the handling of outstanding BPF ring-buffer records. The upstream fix tracks the oldest pending record position and rejects reservations when the range of outstanding records would exceed the ring-buffer size. Red Hat rates the issue **Moderate** (CVSS 3.1: 4.4), requiring local high privileges and primarily enabling denial of service; NVD assigns 5.5, while CVE.org reports 7.8 with confidentiality and integrity impacts. Red Hat issued kernel updates for multiple RHEL 8 and RHEL 9 streams, including extended-support variants, and reports no qualifying mitigation beyond applying the updates.
Aug 26, 2026