Loading story…
CVE-2022-48743 affects the Linux kernel's AMD XGBE Ethernet driver: inconsistent hardware descriptors can cause an skb data-length underflow, reaching a BUG_ON() condition in skbuff handling and intermittently panicking the kernel. The result is a local denial of service; Red Hat rates the flaw Low severity (CVSS 3.1 4.4), while NVD assigns a 5.5 score.
Upstream remediation drops packets when an underflow is detected. The fix is included in stable kernels beginning with 4.9.300, 4.14.265, 4.19.228, 5.4.177, 5.10.97, 5.15.20, 5.16.6, and 5.17, and Red Hat released kernel and kernel-rt updates for affected RHEL 8 and 9 streams, including EUS and specialized variants; RHEL 6 is not affected.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 and RHSA-2024:5102 to address CVE-2022-48743 in Red Hat Enterprise Linux 8 kernel and kernel-rt packages.
Red Hat released RHSA-2024:4928, providing a kernel fix for CVE-2022-48743 in Red Hat Enterprise Linux 9.
Red Hat released RHSA-2024:4902 to fix CVE-2022-48743 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat released RHSA-2024:4823 and RHSA-2024:4831 to address CVE-2022-48743 in Red Hat Enterprise Linux 9.2 Extended Update Support kernel and kernel-rt packages.
Avinash Hanwate reported the vulnerability to Red Hat, where it was tracked as Bug 2293316 and classified as low priority and low severity.
Red Hat released RHSA-2024:6206 to address CVE-2022-48743 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
The Linux kernel CVE team assigned CVE-2022-48743 to an skb data-length underflow in the AMD XGBE Ethernet driver. Inconsistent hardware descriptors can trigger a BUG_ON() and intermittent kernel panics; upstream remediation drops packets when the underflow is detected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-38586** affects the Linux kernel's `r8169` network driver: transmitting small fragmented packets can insert invalid descriptors into the transmit ring buffer and lead to `dma_unmap_single()` being called with a null address. The flaw is categorized as **CWE-457**, use of an uninitialized variable, and can cause kernel instability or denial of service; NVD scored it 7.8 CVSS v3.1, while Red Hat rated it Moderate with a 4.1 score. Upstream fixes are available in Linux kernel versions 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3, and 6.10-rc1. Red Hat issued kernel updates for affected RHEL 8 and RHEL 9 streams, including applicable extended-support and specialized variants; RHEL 6 is not affected. Organizations running systems with Realtek `r8169` adapters should apply their vendor-provided kernel updates and reboot into the patched kernel.
Aug 26, 2026
**CVE-2023-45871** is an Important-rated buffer overflow in the Linux kernel’s Intel IGB Ethernet driver. When `rx-all`/store-bad-packet behavior is enabled, an oversized physical-layer frame can overflow a receive-ring buffer in `igb_configure_rx_ring`, potentially compromising system confidentiality, integrity, and availability. Red Hat assigned the flaw a CVSS v3.1 score of 7.5; exploitation requires an adjacent-network attacker and is considered high complexity because it depends on oversized frames and a non-default configuration. The upstream kernel fix updates `igb_set_rx_buffer_len` to allocate large receive buffers on systems with page sizes below 8192 bytes when either frames exceed `IGB_MAX_FRAME_BUILD_SKB` or the `E1000_RCTL_SBP` receive-control flag is set. Red Hat released corrected kernel, `kernel-rt`, and `kpatch` packages for affected Red Hat Enterprise Linux 7 and 8 streams in February and March 2024, with no qualifying mitigation listed at the time of its advisory.
Aug 26, 2026
**CVE-2023-42754** is a moderate-severity NULL-pointer dereference in the Linux kernel IPv4 routing stack that can allow a local attacker to crash an affected host. When traffic is rerouted through IPVS, an `sk_buff` may lack an associated network device, but `ipv4_send_dest_unreach()` assumes `skb->dev` is present and dereferences it through `dev_net(skb->dev)`, triggering a kernel panic. A proof of concept produced a KASAN-detected fault and fatal panic on a Linux 6.1.47+ test kernel. The upstream correction, commit `0113d9c9d1ccc07f5a3710dac4aa24b6d711278c`, was incorporated in Linux 6.6-rc3 and queued for stable kernel branches from 4.14 through 6.5. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact; fixed kernel packages are available for RHEL 8 and RHEL 9, while RHEL 9 `kernel-rt` remained affected in Red Hat's advisory. RHEL 6, RHEL 7, and RHEL 7 `kernel-rt` are not affected, and Red Hat lists no qualifying mitigation beyond applying updated packages.
Aug 26, 2026