Loading story…
CVE-2021-47304 is a low-severity Linux kernel TCP flaw in tcp_init_transfer() that resets the icsk_ca_initialized state. A local low-privileged process can initiate a TCP Fast Open connection, change TCP congestion control while the socket remains in TCP_SYN_SENT, and cause congestion-control initialization to run twice without the required intervening release operation. Modules such as CDG that allocate memory during initialization can leak memory, creating an availability impact.
The flaw was introduced in Linux 5.10 and fixed upstream in kernel versions 5.10.53, 5.13.5, and 5.14. Red Hat assigned a CVSS v3.1 score of 5.5 and remediated affected RHEL 8 kernel and kernel-rt packages through RHSA-2024:5101 and RHSA-2024:5102; RHEL 9 is not affected, while RHEL 6 and 7 are outside support scope. Organizations should deploy the applicable vendor kernel updates or move to a current stable kernel release.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat addressed the vulnerability in RHEL 8 kernel packages through RHSA-2024:5101 and in kernel-rt packages through RHSA-2024:5102; RHEL 9 was listed as not affected.
Red Hat's bug record for CVE-2021-47304 was reported and classified the Linux kernel issue as low severity.
The Linux kernel CVE team assigned CVE-2021-47304 to the TCP congestion-control initialization issue.
Upstream fixes were included in Linux kernel versions 5.10.53, 5.13.5, and 5.14, changing tcp_init_transfer() so it no longer resets icsk_ca_initialized.
A Linux TCP change caused tcp_init_transfer() to reset icsk_ca_initialized, allowing congestion-control initialization to run twice without an intervening release and potentially leak memory in modules such as CDG.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026
**CVE-2024-26826** is a moderate-severity Linux kernel flaw in Multipath TCP (MPTCP) that can cause unacknowledged data to be lost when a subflow becomes stale. An invalid optimization invoked a TCP-specific retransmission-queue helper on an MPTCP socket; following a TCP fast-path variable reorganization, the check could skip required data reinjection, creating a denial-of-service condition through lost retransmitted packets. The defect was introduced in kernel version 5.15. The issue is fixed in stable kernels `5.15.149`, `6.1.79`, `6.6.18`, `6.7.6`, and `6.8` and later. Red Hat rated the vulnerability CVSS 3.1 **5.5** (moderate), citing local low-complexity exploitation with low privileges and high availability impact, and released updated kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems; RHEL 6 is not affected. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual patch.
Aug 26, 2026
Red Hat released **RHSA-2025:21931** kernel updates for Red Hat Enterprise Linux 10 that remediate `CVE-2025-39955`, a TCP Fast Open (TFO) state-management flaw. The vulnerability occurs when a server-side TFO socket is reused as a client before its prior TFO operation completes, potentially leaving `tcp_sk(sk)->fastopen_rsk` referencing a freed `request_sock`; a retransmission timer may then access the stale object, causing a kernel warning and potentially enabling use-after-free or information-disclosure conditions. Red Hat rates the issue Moderate severity with a CVSS v3.1 score of 7.6 and notes that exploitation requires local access and the ability to create and manipulate TFO sockets, typically in privileged or test environments. The advisory updates RHEL 10 kernels for x86_64, s390x, ppc64le, and aarch64, including applicable extended-support variants; it also fixes the NFS filehandle bounds-checking vulnerability `CVE-2025-39730`. Organizations should apply the updated kernel packages and reboot affected hosts.
Aug 25, 2026