Loading story…
Red Hat addressed CVE-2023-35001, a high-severity out-of-bounds memory-access vulnerability in the Linux kernel Netfilter nf_tables implementation, specifically the nft_byteorder_eval() function. Failed bounds checking and incorrect data alignment can allow an attacker holding CAP_NET_ADMIN in a user or network namespace to escalate privileges locally; Red Hat assigned a CVSS v3.1 score of 7.8, with high impacts to confidentiality, integrity, and availability.
Affected Red Hat Enterprise Linux 7 and 8 kernel, real-time kernel, and kpatch packages received fixes through 2023 advisories. RHSA-2023:7243 supplies fixed 3.10.0-1062.80.1.el7 kernel packages for RHEL 7.7 AUS on x86_64; organizations must reboot after installation. Until updates can be deployed, Red Hat recommends blacklisting the affected Netfilter kernel module to prevent it from loading.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:5621, RHSA-2023:5574, and RHSA-2023:5622 to remediate CVE-2023-35001 in RHEL 7 kernel-rt, kpatch-patch, and kernel packages.
Red Hat released RHSA-2023:5414, providing a kernel fix for CVE-2023-35001 for Red Hat Enterprise Linux 7.6 Advanced Update Support.
Red Hat issued RHSA-2023:5255, RHSA-2023:5221, RHSA-2023:5244, RHSA-2023:5235, and RHSA-2023:5238 to fix CVE-2023-35001 in RHEL 8 kernel, kernel-rt, and kpatch packages, including RHEL 8.1 Update Services for SAP Solutions.
Red Hat published Important advisory RHSA-2023:7243 for RHEL Server AUS 7.7 on x86_64, fixing the nft_byteorder_eval stack out-of-bounds read tracked as CVE-2023-35001. The update provides kernel version 3.10.0-1062.80.1.el7 and requires a reboot for the fix to take effect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:0461** for Red Hat Enterprise Linux 9, updating the kernel to remediate 17 security vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The Important-rated advisory affects RHEL 9 and supported update-service variants on x86_64, ARM64, IBM Z, and IBM Power little-endian systems; administrators must reboot after applying the updated kernel. Among the fixes is **CVE-2023-3777**, a CVSS 7.8 use-after-free flaw in the Linux `nf_tables` netfilter component. A local attacker with `CAP_NET_ADMIN` in a user or network namespace could exploit improper bound-chain validation in `nf_tables_delrule()` to escalate privileges. Red Hat fixed affected RHEL 9 and selected RHEL 9 Extended Update Support kernel and real-time kernel packages, while RHEL 6, 7, and 8 are not affected; pending patching, organizations can prevent the netfilter module from loading and, where operationally feasible, disable user namespaces on non-containerized systems.
Aug 26, 2026
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026
Red Hat remediated **CVE-2022-2078**, a moderate-severity classic buffer overflow (`CWE-120`) in the Linux kernel Netfilter/nftables function `nft_set_desc_concat_parse()`. A low-privileged local attacker could trigger the flaw to cause denial of service and potentially execute code. The vulnerability was fixed upstream in commit `fecf31ee395b0295f2d7260aa29946b7605f7c85`; **CVE-2022-1972** was identified as a duplicate CVE for the same issue. Affected Red Hat products received updated kernel packages for RHEL 8, RHEL 9, and Red Hat Virtualization 4 on RHEL 8; RHEL 6 and RHEL 7 kernels were not affected. RHSA-2022:6582 delivered the RHEL 9 `kernel-rt` fix in version `5.14.0-70.26.1.rt21.98.el9_0`, alongside remediation for CVE-2022-34918. Organizations should install the applicable kernel updates and reboot systems, as no separate Red Hat-supported mitigation was available.
Aug 26, 2026