Loading story…
CVE-2024-26923 is a race condition in the Linux kernel's AF_UNIX socket garbage collector that occurs when garbage collection runs concurrently with connect() on a partially initialized socket carrying SCM_RIGHTS file descriptors. The race can incorrectly increase an in-flight reference count, leave a dangling pointer in gc_inflight_list, and cause inaccurate active-socket accounting, allowing local resource exhaustion and denial of service. The affected code is net/unix/garbage.c, and the issue has existed since Linux kernel 2.6.23.
Exploitation requires local low-privileged access and difficult-to-reproduce timing conditions, but Red Hat assigns a Moderate severity rating with CVSS 7.0. Fixed upstream kernels include 5.15.156, 6.1.87, 6.6.28, 6.8.7, and 6.9-rc4; Red Hat has issued corrected kernel packages for multiple RHEL 8 and RHEL 9 streams. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; no separate mitigation is known.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:7000 and RHSA-2024:7001 for RHEL 8 kernel and kernel-rt packages, and RHSA-2024:6993 for RHEL 8.8 Extended Update Support kernel packages.
Red Hat issued RHSA-2024:4823 and RHSA-2024:4831, providing fixed kernel and kernel-rt packages for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat released RHSA-2024:8617 with fixed Red Hat Enterprise Linux 9 kernel packages for CVE-2024-26923.
RHSA-2024:7486 provided fixed RHEL 8 kernel packages for Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Fixes were made available in Linux kernel versions 5.15.156, 6.1.87, 6.6.28, 6.8.7, and 6.9-rc4. The fix synchronizes the listening socket state so garbage collection cannot observe an inconsistent SCM_RIGHTS-bearing socket graph during connect().
The Linux kernel CVE team assigned CVE-2024-26923 to a race between AF_UNIX socket garbage collection and connect() processing. The flaw, introduced in Linux kernel 2.6.23, can leave an incorrect in-flight reference count and a dangling pointer in gc_inflight_list.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026