Loading story…
CVE-2021-47352 is an improper input-validation flaw in the Linux kernel's virtio-net driver. A malicious or untrusted virtio device can provide an invalid used-length value, potentially causing data corruption, data loss, or an availability disruption. The upstream fix adds validation of the used length and is included in Linux kernel versions 5.10.51, 5.12.18, 5.13.3, and 5.14 and later stable releases.
Red Hat rated the issue Moderate (CVSS 4.4), while NVD and cve.org assigned scores of 7.8 and 8.4 under different privilege and impact assumptions. Red Hat shipped fixes for affected RHEL 8 kernel and kernel-rt packages through advisories including RHSA-2024:6753, RHSA-2024:6993, RHSA-2024:7000, and RHSA-2024:7001; RHEL 9 is not affected, and RHEL 6 and 7 are outside support scope. No practical mitigation is identified, so organizations should update affected systems to current vendor-supported kernel releases rather than cherry-picking the patch.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:6993 for RHEL 8.8 Extended Update Support and RHSA-2024:7000 and RHSA-2024:7001 for RHEL 8 kernel and kernel-rt packages, addressing CVE-2021-47352.
Red Hat released RHSA-2024:6753, fixing CVE-2021-47352 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
The issue was fixed in Linux kernel versions 5.10.51, 5.12.18, 5.13.3, and 5.14 through commits adding validation for the virtio-net used-length value. The kernel CVE team recommended updating to a current stable release rather than cherry-picking fixes.
The Linux kernel CVE team assigned CVE-2021-47352 to an improper used-length validation flaw in the virtio-net driver. A malicious or invalid length supplied by an untrusted virtio device could cause data corruption or data loss.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
**CVE-2025-39973** affects the Linux kernel’s Intel i40e Ethernet driver: a malicious virtual function can provide an oversized or misaligned `ring_len` value that is passed to a hardware memory context without adequate validation. The condition can create excessive transmit or receive queue lengths, potentially resulting in memory corruption or undefined behavior. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.5, while CVE.org assigns 8.8 under different environmental assumptions; RHEL 7 through 10, including applicable real-time kernels, are listed as affected, while RHEL 6 is not affected. The defect aligns with **CWE-131**, incorrect calculation of buffer size, a memory-safety weakness that can lead to out-of-bounds access, crashes, sensitive-data exposure, or code execution. Red Hat’s RHSA-2025:21469 provides updated RHEL 9 kernel packages for multiple kernel security issues and requires a reboot after installation; however, Red Hat’s CVE record separately reports no qualifying mitigation for CVE-2025-39973. Organizations should identify systems using affected i40e hardware and virtual-function configurations, apply applicable vendor kernel updates, reboot hosts, and restrict untrusted VF access where operationally possible.
Aug 25, 2026
**CVE-2022-36946** is a Linux kernel Netfilter `nfnetlink_queue` flaw in `nfqnl_mangle()` that allows a user able to create Netfilter rules to truncate a queued packet below its required transport-header offset. Processing an `NFQNL_MSG_VERDICT` with an invalidly short `NFA_PAYLOAD` can create a malformed socket buffer; subsequent IPv4 or IPv6 header handling can then panic the kernel and deny service. A one-byte payload was reported as sufficient to trigger the condition. Upstream fixed the issue in Linux kernel `5.18.16` by enforcing a minimum packet length and returning `-EINVAL` for invalid truncation requests. Red Hat rated the locally initiated issue Moderate (CVSS 6.2) and released fixes for affected RHEL 8, RHEL 9, RHEL 8.6 EUS, and Red Hat Virtualization 4 packages; organizations unable to patch can mitigate exposure by preventing the `nfnetlink_queue` kernel module from loading.
Aug 26, 2026