Loading story…
CVE-2023-52809 affects the Linux kernel SCSI libfc component: fc_lport_ptp_setup() failed to verify whether fc_rport_create() returned NULL. A local attacker able to reach the affected Fibre Channel code path could trigger a NULL-pointer dereference, crashing the host and causing denial of service. Red Hat rates the flaw Low severity with a CVSS v3.1 score of 4.4, while NVD assigns 5.5; both identify high availability impact.
Linux stable kernels have been fixed across supported branches, and the kernel CVE team advises updating to the latest stable release rather than cherry-picking the patch. Red Hat issued fixes for RHEL 8 and multiple RHEL 9 streams, including RHEL 9 and 9.2 EUS; kernel-rt packages for RHEL 8 and RHEL 9 remained affected at publication. RHEL 6 and RHEL 7 kernel packages are outside support scope and should be treated as affected.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5066 for the RHEL 9.2 Extended Update Support kernel and RHSA-2024:5067 for its kernel-rt package, addressing CVE-2023-52809.
Red Hat released RHSA-2024:4928 to address CVE-2023-52809 in the Red Hat Enterprise Linux 9 kernel.
The Linux kernel CVE team announced CVE-2023-52809, a SCSI libfc flaw in which fc_lport_ptp_setup() failed to validate a NULL return from fc_rport_create(), potentially causing a kernel NULL-pointer dereference. Stable-kernel fixes were made available across versions 4.14.331 through 6.7.
Red Hat released RHSA-2024:7000 to fix CVE-2023-52809 in the Red Hat Enterprise Linux 8 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-36952** is a moderate-severity flaw in the Linux kernel's `lpfc` SCSI driver affecting its NPIV virtual-port cleanup path. A race condition can unregister a virtual port and free its remote-port object before the driver sends its final Remove All DA_ID CT and LOGO ELS requests, causing a Fibre Channel fabric switch to retain an incorrect logged-in NPIV session state. Red Hat rated the issue CVSS v3.1 4.4 and released fixes for supported Red Hat Enterprise Linux 8 and 9 streams; RHEL 6 and 7 are outside support scope. The correction defers `fc_remove_host()` and `scsi_remove_host()` until after the DA_ID and LOGO messages are transmitted, addressing an incomplete-cleanup condition consistent with **CWE-459**.
Aug 26, 2026
A flaw tracked as **CVE-2026-46086** in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing `br_fdb_fillbuf()` to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue **Moderate** with a **CVSS v3.1 score of 5.5**, classifying it as a **CWE-367** time-of-check time-of-use race condition with denial-of-service impact only. Upstream kernel maintainers fixed the issue by taking a stable snapshot of `f->dst` with `READ_ONCE()` in affected RCU readers and using `WRITE_ONCE()` for in-place updates in `fdb_delete_local()`. The vulnerability was introduced in kernel **3.14** and patched in stable releases including **6.6.140**, **6.12.86**, **6.18.27**, **7.0.4**, and **7.1-rc1**. Red Hat said fixes are available for **RHEL 8** `kernel` and `kernel-rt`, **RHEL 9** `kernel`, and **RHEL 10** `kernel`, while **RHEL 7** `kernel`, **RHEL 7 kernel-rt`, and **RHEL 9 kernel-rt** remain affected; **RHEL 6** is out of support and should be assumed vulnerable.
Aug 25, 2026
**CVE-2023-2177** is a moderate-severity NULL-pointer dereference in the Linux kernel's SCTP stream scheduler, in `net/sctp/stream_sched.c`. On kernels before version 5.19, a failed `stream_in` allocation can free `stream_out` before later code accesses it. A local low-privileged user could trigger a kernel crash and cause denial of service; the issue has no reported confidentiality or integrity impact and carries a Red Hat CVSS v3.1 score of 5.5. An upstream patch corrected SCTP association and stream-initialization error handling by routing failed `sctp_stream_init()` operations through the dedicated stream cleanup path and centralizing allocation-failure cleanup. Red Hat issued errata for affected Red Hat Enterprise Linux 8, RHEL 8.6 Extended Update Support, and RHEL 9 kernel packages; RHEL 6 and 7 variants were listed as not affected. Organizations should deploy the applicable kernel updates, as no separate mitigation is available.
Aug 26, 2026