Loading story…
CVE-2023-42754 is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an sk_buff may lack an associated network device, but ipv4_send_dest_unreach() assumes skb->dev is present and dereferences it through dev_net(skb->dev), triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel.
The upstream correction, commit 0113d9c9d1ccc07f5a3710dac4aa24b6d711278c, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 kernel-rt remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 kernel-rt are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat addressed CVE-2023-42754 in Red Hat Enterprise Linux 9 kernel packages through advisory RHSA-2024:2394.
Patrick Del Bello reported a missing edge-case check in ipv4_send_dest_unreach() that could dereference a NULL pointer and crash the Linux kernel. The report was made on September 20, 2023.
Red Hat issued RHSA-2024:3138 for the RHEL 8 kernel and RHSA-2024:2950 for the RHEL 8 kernel-rt package, addressing CVE-2023-42754.
A supplied proof of concept triggered a KASAN-detected NULL-pointer dereference, general-protection fault, and fatal kernel panic on a Linux 6.1.47+ test kernel after IPVS rerouting.
A patch prepared by Kyle Zeng was merged into the upstream Linux networking tree, fixing the IPVS-rerouting condition where skb->dev can be NULL. The fix was incorporated in Linux 6.6-rc3 and queued for multiple stable branches, including 6.5, 6.1, 5.15, 5.10, 5.4, 4.19, and 4.14.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026