Loading story…
CVE-2024-27397 is a use-after-free flaw in the Linux kernel's netfilter/nf_tables subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1.
The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected kernel and kernel-rt packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:4352, fixing CVE-2024-27397 in the Red Hat Enterprise Linux 8 kernel-rt package.
Red Hat released RHSA-2024:4211, providing a fix for CVE-2024-27397 in the Red Hat Enterprise Linux 8 kernel.
Red Hat released RHSA-2024:4108, fixing CVE-2024-27397 in the Red Hat Enterprise Linux 9.2 Extended Update Support kernel.
Red Hat released RHSA-2024:5257 and RHSA-2024:5256 to fix CVE-2024-27397 in RHEL 9.0 SAP Update Services kernel and kernel-rt packages, respectively.
Red Hat released RHSA-2024:4740, fixing CVE-2024-27397 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Red Hat released RHSA-2024:4583, providing a CVE-2024-27397 fix for the Red Hat Enterprise Linux 9 kernel.
Red Hat released RHSA-2024:4447 to fix CVE-2024-27397 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Update Services kernels.
The Linux kernel CVE team documented fixes for the nf_tables transaction-timeout flaw in kernel 6.7.5 and 6.8. The fix records a transaction-start timestamp for relevant set backend operations.
The nf_tables set-element timeout issue underlying CVE-2024-27397 was introduced in Linux kernel 4.1 by commit c3e1b005ed1c.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026
A use-after-free flaw in the Linux kernel's Netfilter nftables `nft_pipapo_walk` function, tracked as **CVE-2023-6817**, can allow a local attacker with `CAP_NET_ADMIN` to crash a host, disclose information, or elevate privileges. The defect allowed inactive PIPAPO set elements to be processed and deactivated twice during a set walk, leading to a kernel crash; it carries a CVSS v3.1 score of 7.8. Linux kernel commit `317eb9685095678f2c9f5a8189de698c5354316a` fixes the issue by verifying that an element is active before invoking the iterator callback. Red Hat issued fixes for affected RHEL 8 `kernel` and `kernel-rt` packages; systems with unprivileged user namespaces enabled may let unprivileged users obtain the required capability. OpenShift Container Platform inherits the affected code through RHCOS, but Red Hat rates impact as Low because its namespace model prevents containers from acquiring the capabilities needed to exploit the flaw.
Aug 26, 2026
Red Hat addressed **CVE-2023-35001**, a high-severity out-of-bounds memory-access vulnerability in the Linux kernel Netfilter `nf_tables` implementation, specifically the `nft_byteorder_eval()` function. Failed bounds checking and incorrect data alignment can allow an attacker holding `CAP_NET_ADMIN` in a user or network namespace to escalate privileges locally; Red Hat assigned a CVSS v3.1 score of 7.8, with high impacts to confidentiality, integrity, and availability. Affected Red Hat Enterprise Linux 7 and 8 kernel, real-time kernel, and kpatch packages received fixes through 2023 advisories. RHSA-2023:7243 supplies fixed `3.10.0-1062.80.1.el7` kernel packages for RHEL 7.7 AUS on x86_64; organizations must reboot after installation. Until updates can be deployed, Red Hat recommends blacklisting the affected Netfilter kernel module to prevent it from loading.
Aug 26, 2026