Loading story…
CVE-2022-36946 is a Linux kernel Netfilter nfnetlink_queue flaw in nfqnl_mangle() that allows a user able to create Netfilter rules to truncate a queued packet below its required transport-header offset. Processing an NFQNL_MSG_VERDICT with an invalidly short NFA_PAYLOAD can create a malformed socket buffer; subsequent IPv4 or IPv6 header handling can then panic the kernel and deny service. A one-byte payload was reported as sufficient to trigger the condition.
Upstream fixed the issue in Linux kernel 5.18.16 by enforcing a minimum packet length and returning -EINVAL for invalid truncation requests. Red Hat rated the locally initiated issue Moderate (CVSS 6.2) and released fixes for affected RHEL 8, RHEL 9, RHEL 8.6 EUS, and Red Hat Virtualization 4 packages; organizations unable to patch can mitigate exposure by preventing the nfnetlink_queue kernel module from loading.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2022:7444 for RHEL 8 kernel-rt and RHSA-2022:7683 for the RHEL 8 kernel to address CVE-2022-36946.
The denial-of-service flaw in the Linux kernel nfnetlink_queue handler, caused by malformed packet truncation in nfqnl_mangle(), was reported.
Florian Westphal proposed a Linux kernel patch to reject nf_queue packet truncation below the transport-header offset after Domingo Dirutigliano and Nicola Guerrera reported that a one-byte NFA_PAYLOAD verdict could panic the kernel.
Fedora received the Linux kernel 5.18.16 stable update fixing CVE-2022-36946.
RHSA-2024:0724 addressed CVE-2022-36946 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8 packages.
Red Hat closed its tracking bug for CVE-2022-36946.
Red Hat issued RHSA-2022:8267 for the RHEL 9 kernel and RHSA-2022:7933 for RHEL 9 kernel-rt to remediate CVE-2022-36946.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026