Loading story…
Red Hat addressed CVE-2020-36516, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel 5.17-rc2.
The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through RHSA-2024:2674 for RHEL 8.6 extended-support channels. That advisory also remediates CVE-2024-26586 in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2022:7444 for RHEL 8 kernel-rt and RHSA-2022:7683 for the RHEL 8 kernel, addressing CVE-2020-36516.
Marian Rehak reported Red Hat bug 2059928 to track CVE-2020-36516, a Linux kernel IPID-assignment issue that could permit off-path TCP data injection or session termination.
Red Hat published RHSA-2024:2674 for RHEL 8.6 extended-support channels. The kernel update, version 4.18.0-372.102.1.el8_6, addressed CVE-2020-36516 and CVE-2024-26586.
Red Hat closed bug 2059928, its tracking record for CVE-2020-36516.
Red Hat released RHSA-2022:7933 for RHEL 9 kernel-rt and RHSA-2022:8267 for the RHEL 9 kernel, addressing CVE-2020-36516.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026
**CVE-2023-42753** is a high-severity Linux kernel Netfilter flaw in the `hash:net,port,net` ipset implementation. A missing `IP_SET_HASH_WITH_NET0` macro causes an incorrect `CIDR_POS(c)` array-offset calculation, permitting integer underflow and an out-of-bounds increment or decrement of the `h->nets` array. A local low-privileged attacker could crash an affected system and potentially elevate privileges; Red Hat rated the issue CVSS 7.0, while NVD assigned 7.8. Upstream corrected the defect in commit `050d91c03b28ca479df13dfb02bcd2c60dd6a878`, with Fedora including the fix in kernel 6.5.3. Red Hat issued updates across affected RHEL 7, 8, and 9 package streams, including RHEL 8.8 live-kernel patches delivered through RHSA-2023:7558; the `kpatch-patch` modules load automatically and apply the fix without a conventional reboot. No practical mitigation is available, so organizations should update affected kernel packages promptly; RHEL 7.6 was assessed as unaffected because it rejects `/0` netmasks.
Aug 26, 2026
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026