Loading story…
CVE-2021-47099 affects the Linux kernel's virtual Ethernet (veth) driver, allowing shared or cloned socket buffers to enter Generic Receive Offload (GRO) processing. Under a configuration where GRO is enabled on a veth interface, TCP Segmentation Offload is disabled on its peer, and no XDP program is attached, the condition can trigger a skb_shift kernel BUG during TCP processing and crash the host. The flaw was introduced by commit d3256efd8e8b in Linux 5.13.
Upstream fixed the issue in Linux 5.15.12 and 5.16 by avoiding GRO processing for shared or cloned buffers and attempting to unclone them first. Red Hat issued fixes for supported RHEL 8 and RHEL 9 kernel packages, including RHEL 8.6 EUS via RHSA-2024:1877; RHEL 6 and 7 are outside supported remediation scope. Red Hat rates the issue Low with CVSS 6.0, while CVE.org lists a 7.8 score; organizations should deploy current stable kernel updates and validate affected veth-based container and virtual-networking configurations.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2022:7683 and RHSA-2022:7444 to fix CVE-2021-47099 in RHEL 8 kernel and kernel-rt packages.
Red Hat released RHSA-2024:1877 to address CVE-2021-47099 for RHEL 8.6 Extended Update Support; the advisory also provided a kernel fix for Red Hat Virtualization 4 on RHEL 8.
Red Hat issued RHSA-2022:8267 and RHSA-2022:7933 to address CVE-2021-47099 in RHEL 9 kernel and kernel-rt packages.
Linux kernel 5.15.12 fixed CVE-2021-47099 with commit d2269ae48598, and Linux 5.16 fixed it with commit 9695b7de5b47. The remediation avoids GRO processing for shared or cloned socket buffers and attempts to unclone buffers first.
Commit d3256efd8e8b, included in Linux kernel 5.13, allowed NAPI on veth devices without XDP and introduced a path where shared or cloned socket buffers could enter GRO without a share check.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2024-35890**, a medium-severity Linux kernel flaw in Generic Receive Offload (GRO) caused by incorrect socket-reference ownership transfer while processing packets with fragment lists. A local, low-privileged attacker could trigger kernel bugs or system instability, producing a high availability impact; Red Hat assigned the issue a CVSS v3.1 score of 5.5. Upstream fixes are included in kernel versions 5.15.154, 6.1.85, 6.6.26, 6.8.5, and 6.9. Red Hat released patched kernel packages across affected RHEL 8 and RHEL 9 streams, including **RHSA-2025:0062** for RHEL 8.8 Extended Update Support and associated service variants. That advisory provides `kernel-4.18.0-477.86.1.el8_8` packages for x86_64, s390x, ppc64le, and aarch64 and also remediates CVE-2024-53122. Administrators should install the applicable kernel updates and reboot systems; RHEL 6 is outside support scope and should be treated as affected.
Aug 26, 2026
**CVE-2023-42754** is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an `sk_buff` may lack an associated network device, but `ipv4_send_dest_unreach()` assumes `skb->dev` is present and dereferences it through `dev_net(skb->dev)`, triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel. The upstream correction, commit `0113d9c9d1ccc07f5a3710dac4aa24b6d711278c`, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 `kernel-rt` remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 `kernel-rt` are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
Aug 26, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026