Loading story…
Red Hat has issued updates for CVE-2021-47408, a moderate-severity improper-locking flaw in the Linux kernel's netfilter conntrack subsystem. Concurrent hash-table resizing and cleanup in nf_ct_iterate_cleanup() are not correctly serialized, allowing prolonged processing delays that can leave an affected system unresponsive; the impact is local denial of service rather than loss of confidentiality or integrity.
Red Hat rated the vulnerability CVSS 4.7 and classified it as CWE-667: Improper Locking, a weakness category associated with race conditions, resource corruption, deadlocks, and blocked access to shared resources. RHEL 8 kernel and kernel-rt updates address the issue, while RHEL 9 is not affected; Red Hat listed no practical mitigation and recommends prompt package updates.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for the RHEL 8 kernel-rt, addressing the netfilter conntrack improper-locking flaw CVE-2021-47408.
The Linux kernel CVE team documented CVE-2021-47408, a conntrack race between hash-table resizing and cleanup that could delay network-namespace teardown. The fix serializes resizing and cleanup with a mutex and was included in kernel versions 5.10.71, 5.14.10, and 5.15.
CWE-667 was formerly named “Insufficient Locking”; the CWE entry indicates the name had changed before December 13, 2010.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026
Red Hat released multiple kernel security advisories for **Red Hat Enterprise Linux 8** and **RHEL 9.2** variants, including Update Services for SAP Solutions and Extended Life Cycle channels, to address a set of Linux kernel vulnerabilities affecting locking, virtualization, and networking code. The updates remediate five flaws in the RHEL 9.2 packages—`CVE-2026-43027`, `CVE-2026-43499`, `CVE-2026-46113`, `CVE-2026-53166`, and `CVE-2026-53359`—covering issues in **netfilter**, **rtmutex**, **futex/requeue**, and two **KVM x86 shadow paging** use-after-free conditions. A separate RHEL 8 advisory fixes eight kernel vulnerabilities spanning **net/sched**, **IOMMU**, **ATM networking**, **rtmutex**, **futex**, **KVM x86 shadow paging**, and **netfilter ebtables**. One of the patched bugs, `CVE-2026-53166`, is a moderate-severity flaw in the futex requeue mechanism that can trigger a **NULL pointer dereference** and crash the kernel during a self-deadlock scenario, resulting in local denial of service. Red Hat grouped that issue with `CVE-2026-43499` in its **"GhostLock"** bulletin, warning that the affected futex priority-inheritance code is built into standard RHEL kernels and that no runtime mitigation is available. The company urged customers to install the updated kernel packages and **reboot** affected systems for the fixes to take effect.
Aug 28, 2026
Red Hat released Important Linux-kernel updates for **RHEL 8**, RHEL 9, and RHEL 8.1 Update Services for SAP Solutions to address **CVE-2022-32250**, a netfilter `nf_tables` use-after-free write that a local attacker could exploit to gain root privileges. The advisories also remediate **CVE-2022-1012**, in which predictable TCP source-port generation can allow a network observer to fingerprint hosts, infer traffic patterns, and estimate outbound connections. RHEL 9 updates additionally address **CVE-2022-1729**, a `perf_event_open` race condition permitting privilege escalation, and an IPsec ESP buffer-overflow flaw. Affected administrators should install the applicable updated kernel packages and reboot systems for the fixes to take effect; RHEL 8 version `4.18.0-372.19.1.el8_6` was provided for supported variants and x86_64, aarch64, ppc64le, and s390x architectures. The updates also include stability and performance corrections affecting dm-integrity, SR-IOV, SCTP, asymmetric TCP routing, and virtual-machine booting. Tracking for the netfilter flaw should use **CVE-2022-32250**: **CVE-2022-1966** was rejected as a duplicate. Red Hat notes RHEL 7 is not affected by CVE-2022-1012 because it uses a different TCP port-selection algorithm.
Aug 26, 2026