Loading story…
CVE-2022-48757 is a Linux kernel networking information-disclosure flaw in /proc/net/ptype. A packet socket created without binding to a device in one network namespace could expose its associated packet_type entry to users reading that interface from another namespace, weakening expected namespace isolation. The defect existed since Linux kernel 2.6.26.
Upstream corrected the issue by associating each packet_type with its network namespace and filtering entries during ptype_seq_show; fixes were backported to kernels including 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17. Red Hat rates the issue Low with CVSS 3.3, has issued RHEL 8 and RHEL 8.8 EUS updates, and advises applying supported kernel updates; RHEL 9 fixes were deferred, while RHEL 6 and 7 are outside support scope.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:5101 for RHEL 8 kernel updates and RHSA-2024:5102 for RHEL 8 kernel-rt updates addressing CVE-2022-48757.
Red Hat reported its security record for CVE-2022-48757, a low-severity Linux kernel information-disclosure issue affecting /proc/net/ptype.
Red Hat issued RHSA-2024:6206, providing a kernel update for Red Hat Enterprise Linux 8.8 Extended Update Support that addresses CVE-2022-48757.
The Linux kernel remediation associated packet_type entries with their corresponding network namespace and made ptype_seq_show filter entries accordingly. The fix was backported through stable releases 4.4.302, 4.9.300, 4.14.265, 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17.
The cross-network-namespace information-leak issue in /proc/net/ptype was introduced by commit 2feb27dbe00c in Linux kernel version 2.6.26.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2021-47257** is a Linux kernel flaw in `net/ieee802154/nl802154.c` that mishandles device-address parsing in the IEEE 802.15.4 networking subsystem. A local user that supplies an invalid mode for an address type can trigger a NULL-pointer dereference and crash the kernel, causing denial of service; the issue has no reported confidentiality or integrity impact. The flaw was fixed in Linux kernel versions 4.9.274, 4.14.238, 4.19.196, 5.4.127, 5.10.45, 5.12.12, and 5.13 and later stable releases. Red Hat rated it Low severity (CVSS 5.5) and issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; RHEL 6 and RHEL 9 are not affected, while RHEL 7 is outside support scope. Organizations should deploy current vendor kernel updates rather than cherry-picking the individual fix.
Aug 26, 2026
**CVE-2022-3566** is a race condition in the Linux kernel TCP subsystem involving concurrent access to `icsk->icsk_af_ops`. A low-privileged attacker with adjacent-network access could exploit the flaw to disclose internal kernel or Internet Protocol information and potentially affect system confidentiality, integrity, and availability. Red Hat rates the issue Moderate at CVSS 4.6, while the NVD score is 7.1. Red Hat released fixed kernel and real-time kernel packages for affected Red Hat Enterprise Linux 8 and 9 deployments, including RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8. RHEL 6 and 7 are outside support scope, and Red Hat identified no qualifying workaround; organizations should upgrade affected systems to supported fixed kernel packages. The issue reflects CWE-366, where unsynchronized concurrent access to shared resources can leave data or execution state invalid or unexpected.
Aug 26, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026