Loading story…
CVE-2023-52620 affects the Linux kernel's Netfilter nf_tables component, where a local low-privileged user could assign timeout values to anonymous sets—an unsupported state that may trigger unexpected behavior or security consequences. Red Hat rates the flaw moderate with CVSS v3.1 2.5, citing high attack complexity and low availability impact.
The upstream fix disallows timeouts for anonymous sets and is included in kernel versions 5.15.151, 6.1.81, and 6.4. Red Hat released fixes for Red Hat Enterprise Linux 8 and 9 through advisories including RHSA-2024:2394, RHSA-2024:2950, and RHSA-2024:3138; RHEL 6 and 7 kernel packages are outside support scope, and Red Hat identified no practical mitigation beyond applying updated kernel packages.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:3306 to fix CVE-2024-26642 in Red Hat Enterprise Linux 9 kernel packages. The flaw concerns anonymous nf_tables sets accepted with the timeout flag.
Red Hat released RHSA-2024:2394 to address CVE-2023-52620 in Red Hat Enterprise Linux 9 kernel packages.
The Linux kernel CVE team assigned CVE-2024-26642 for a netfilter nf_tables issue involving anonymous sets configured with the timeout flag. The upstream advisory documented a fix that disallows such anonymous timeout-enabled sets.
The Linux kernel CVE team announced CVE-2023-52620, a netfilter nf_tables issue involving timeout parameters on anonymous sets. The fix disallows those parameters, with fixes available in Linux 5.15.151, 6.1.81, and 6.4.
Marco Benatto reported Red Hat Bug 2270883 for CVE-2023-52620, affecting the Linux kernel Netfilter nf_tables subsystem. The issue involves userspace setting unsupported timeout values on anonymous sets.
Red Hat released RHSA-2024:3138 for affected RHEL 8 kernel packages and RHSA-2024:2950 for RHEL 8 kernel-rt packages, addressing CVE-2023-52620.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2023-35001**, a high-severity out-of-bounds memory-access vulnerability in the Linux kernel Netfilter `nf_tables` implementation, specifically the `nft_byteorder_eval()` function. Failed bounds checking and incorrect data alignment can allow an attacker holding `CAP_NET_ADMIN` in a user or network namespace to escalate privileges locally; Red Hat assigned a CVSS v3.1 score of 7.8, with high impacts to confidentiality, integrity, and availability. Affected Red Hat Enterprise Linux 7 and 8 kernel, real-time kernel, and kpatch packages received fixes through 2023 advisories. RHSA-2023:7243 supplies fixed `3.10.0-1062.80.1.el7` kernel packages for RHEL 7.7 AUS on x86_64; organizations must reboot after installation. Until updates can be deployed, Red Hat recommends blacklisting the affected Netfilter kernel module to prevent it from loading.
Aug 26, 2026
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026