Loading story…
CVE-2023-2177 is a moderate-severity NULL-pointer dereference in the Linux kernel's SCTP stream scheduler, in net/sctp/stream_sched.c. On kernels before version 5.19, a failed stream_in allocation can free stream_out before later code accesses it. A local low-privileged user could trigger a kernel crash and cause denial of service; the issue has no reported confidentiality or integrity impact and carries a Red Hat CVSS v3.1 score of 5.5.
An upstream patch corrected SCTP association and stream-initialization error handling by routing failed sctp_stream_init() operations through the dedicated stream cleanup path and centralizing allocation-failure cleanup. Red Hat issued errata for affected Red Hat Enterprise Linux 8, RHEL 8.6 Extended Update Support, and RHEL 9 kernel packages; RHEL 6 and 7 variants were listed as not affected. Organizations should deploy the applicable kernel updates, as no separate mitigation is available.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2951 for Red Hat Enterprise Linux 8 kernel packages and RHSA-2023:2736 for RHEL 8 kernel-rt packages to fix CVE-2023-2177.
Red Hat issued RHSA-2023:2458 for Red Hat Enterprise Linux 9 kernel packages and RHSA-2023:2148 for RHEL 9 kernel-rt packages to address CVE-2023-2177.
Red Hat issued RHSA-2023:7398 to address CVE-2023-2177 in Red Hat Enterprise Linux 8.6 Extended Update Support kernel packages and Red Hat Virtualization 4 for RHEL 8.
The netdev Linux kernel tree changed SCTP stream-initialization error handling so failed allocations are returned to the caller and cleaned up through the appropriate stream-free path, addressing the condition associated with CVE-2023-2177.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-38684** is a moderate-severity flaw in the Linux kernel's Enhanced Transmission Selection (ETS) traffic-control scheduler. A faulty update sequence in `ets_qdisc_change()` updates `q->nbands` before unused DWRR classes are purged, leaving cleanup logic to operate on an inconsistent ETS configuration and potentially dereference a NULL pointer. A local attacker can trigger a kernel crash, resulting in denial of service; Red Hat rates the issue CVSS 5.2, while NVD assigns 5.5. Red Hat has released fixes for standard kernels in RHEL 8, RHEL 9, and RHEL 10. Fixes for the RHEL 8 and RHEL 9 real-time kernels remain deferred, while RHEL 6, RHEL 7, and the RHEL 7 real-time kernel are not affected because they lack the vulnerable code. Organizations using affected kernel packages should apply the available updates and plan mitigation for affected real-time deployments until fixes are released.
Aug 26, 2026
A long-standing Linux kernel flaw in SCTP Dynamic Address Reconfiguration, tracked as **CVE-2026-64564** and dubbed **SCTPhantom**, was disclosed as a deterministic use-after-free bug that can let a low-privileged local user gain **root** privileges and potentially escape from a container to the host. The vulnerability affects ASCONF handling, where a crafted sequence of `DEL-IP` operations can free an SCTP transport and later reuse the dangling pointer. Researchers said the vulnerable logic dates back to **Linux 2.6.25** and reported successful exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9-family systems, OpenCloudOS, and a Linux 7.2 release candidate, including multiple tested host-root container escapes. Fixes are available in mainline commit `9b2854f86f0b` and in stable kernel releases **6.6.148**, **6.12.101**, **6.18.42**, **7.1.6**, and **7.2-rc5**. Discussion on the oss-sec mailing list noted that practical exposure varies by distribution: on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in the `kernel-modules-extra` package and is blacklisted for autoload, meaning administrators would generally need to explicitly install and load the module for the bug to be reachable. Defenders were urged to patch affected kernels or disable SCTP where it is not required.
Aug 12, 2026
**CVE-2023-52809** affects the Linux kernel SCSI `libfc` component: `fc_lport_ptp_setup()` failed to verify whether `fc_rport_create()` returned `NULL`. A local attacker able to reach the affected Fibre Channel code path could trigger a NULL-pointer dereference, crashing the host and causing denial of service. Red Hat rates the flaw Low severity with a CVSS v3.1 score of 4.4, while NVD assigns 5.5; both identify high availability impact. Linux stable kernels have been fixed across supported branches, and the kernel CVE team advises updating to the latest stable release rather than cherry-picking the patch. Red Hat issued fixes for RHEL 8 and multiple RHEL 9 streams, including RHEL 9 and 9.2 EUS; `kernel-rt` packages for RHEL 8 and RHEL 9 remained affected at publication. RHEL 6 and RHEL 7 kernel packages are outside support scope and should be treated as affected.
Aug 26, 2026