Loading story…
A flaw in the Linux kernel CAN networking receive path, tracked as CVE-2023-2166, can allow a local low-privileged user to crash an affected system. The defect occurs when can_rcv_filter handles received CAN frames and dereferences the CAN-specific ml_priv pointer without confirming it was initialized, resulting in a NULL-pointer dereference and denial of service.
The condition can arise because bonding or TUN network devices may report the CAN hardware type (ARPHRD_CAN) without initializing ml_priv; the issue was reported by syzbot and Wei Chen and fixed upstream by adding the required initialization check. Red Hat rates the issue CVSS 5.5 (Moderate), with availability impact only, and released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems in errata including RHSA-2024:0461, RHSA-2024:0881, and RHSA-2024:0897.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:0881 for RHEL 8 kernel-rt and RHSA-2024:0897 for the RHEL 8 kernel, addressing CVE-2023-2166.
Red Hat released RHSA-2024:0724 to fix CVE-2023-2166 for the Red Hat Enterprise Linux 8.6 Extended Update Support kernel.
Red Hat released RHSA-2024:0461 to fix CVE-2023-2166 for the Red Hat Enterprise Linux 9 kernel.
Linux upstream commit 0acc442309a0a1b01bcdaa135e56e6398a49439c added validation for the CAN-specific ml_priv pointer in the CAN receive path. The flaw could be triggered by bonding or TUN devices reporting ARPHRD_CAN without initializing ml_priv.
Red Hat released RHSA-2024:3528 to fix CVE-2023-2166 in the Red Hat Enterprise Linux 8.2 Advanced Update Support kernel.
Red Hat issued RHSA-2024:1367 for RHEL 8.4 Advanced Mission Critical Update Support, RHSA-2024:1382 for RHEL 8.4 Telecommunications Update Service kernel-rt, and RHSA-2024:1404 for RHEL 8.8 Extended Update Support, fixing CVE-2023-2166.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed and patched **CVE-2023-52922**, an Important use-after-free flaw in the Linux kernel's CAN Broadcast Manager (**CAN BCM**) subsystem that could let local, unprivileged users disclose kernel memory on **RHEL 9**. The bug stemmed from `bcm_release()` freeing `bcm_op` objects before removing their procfs entries, allowing `bcm_proc_show()` to read freed memory concurrently through `/proc/net/can-bcm`. Red Hat rated the issue **CVSS 7.8** and warned it could lead to information disclosure, denial of service, memory corruption, and potentially code execution; fixes were shipped in March 2025 through RHEL 9 kernel advisories including **RHSA-2025:2627** and kernel version `5.14.0-503.31.1.el9_5`. Research published by Allele Security showed the flaw could be exploited in environments where unprivileged user and network namespaces are enabled and a CAN interface can be created, such as with **VXCAN**, to leak encoded **SLUB** freelist pointers and slab addresses useful for bypassing kernel mitigations. The upstream Linux fix, commit `55c3b96`, reordered CAN BCM cleanup so the procfs entry is removed earlier, and the researchers later released proof-of-concept code and noted the subsystem contained additional procfs-related memory-safety issues, including **CVE-2025-38003** and **CVE-2025-38004**; a later upstream patch, commit `dac5e62`, added missing **RCU** read protection for CAN BCM procfs handling.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026
**CVE-2023-42754** is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an `sk_buff` may lack an associated network device, but `ipv4_send_dest_unreach()` assumes `skb->dev` is present and dereferences it through `dev_net(skb->dev)`, triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel. The upstream correction, commit `0113d9c9d1ccc07f5a3710dac4aa24b6d711278c`, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 `kernel-rt` remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 `kernel-rt` are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
Aug 26, 2026