Loading story…
CVE-2024-26804 is a use-after-free flaw in the Linux kernel's IPv4 ip_tunnel infrastructure that allows a low-privileged local user to crash an affected system. Recursive GRE or IPIP tunnel routing can cause a tunnel device's needed_headroom to increase indefinitely; after the packet buffer headroom exceeds 64 KiB, the 16-bit skb->network_header field can wrap, resulting in an out-of-bounds packet-buffer adjustment and use-after-free condition.
The issue has existed since kernel version 2.6.34 and is fixed in stable releases 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, and 6.8 or later. Red Hat rates the issue as moderate severity with CVSS 5.5 and has issued updates for affected RHEL 8 and 9 streams; RHEL 6 is unsupported and should be considered affected. Organizations should deploy vendor kernel updates or move to a current stable kernel release rather than cherry-picking the individual patch.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:4352, providing RHEL 8 kernel-rt updates that fix CVE-2024-26804.
Red Hat issued RHSA-2024:4211 with RHEL 8 kernel updates that remediate CVE-2024-26804.
RHSA-2024:3461 and RHSA-2024:3460 provided kernel and kernel-rt fixes, respectively, for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat released RHSA-2024:3306, providing RHEL 9 kernel updates that fix CVE-2024-26804.
Red Hat issued RHSA-2024:4740 to fix CVE-2024-26804 in the RHEL 8.8 Extended Update Support stream.
RHSA-2024:4447 delivered fixes for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
The Linux kernel CVE team assigned CVE-2024-26804 to the IPv4 IP-tunnel issue. Fixes that cap needed_headroom growth were included in stable kernel releases 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, and 6.8.
The perpetual IP-tunnel headroom-growth flaw was introduced in Linux kernel 2.6.34 by commit 243aad830e8a. Recursive GRE and IPIP routing could ultimately trigger an out-of-bounds skb adjustment and use-after-free.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
Red Hat disclosed **CVE-2026-43037**, a critical Linux kernel flaw in the `ip6_tunnel` component that can be triggered by malicious ICMPv6 error messages against IPv4-over-IPv6 tunnel handling. The bug stems from reusing a cloned socket buffer control block with incompatible IPv6 and IPv4 metadata layouts, a form of **type confusion** tracked by MITRE as `CWE-843`. In the vulnerable path, `__ip_options_echo()` can interpret attacker-controlled packet data as IPv4 option data and copy an attacker-influenced length into a fixed 40-byte stack buffer, creating stack-based memory corruption that can cause denial of service and potentially arbitrary code execution with kernel privileges. Red Hat rated the issue **CVSS 8.8** and published fixes across multiple RHEL and related product streams, including **RHSA-2026:27719** for RHEL 6 Extended Lifecycle Support Extension. The upstream fix clears `skb2->cb[]` before calling `icmp_send()` and adds minimal IPv4 header validation requiring version 4 and an IHL of at least 5. Red Hat said updated kernel packages are available, including `kernel-2.6.32-754.61.1.el6` for affected RHEL 6 ELS architectures, advised customers to reboot after applying updates, and recommended preventing the `ip6_tunnel` module from loading as a temporary mitigation until patches are installed.
Aug 25, 2026
**CVE-2022-20141** is a use-after-free flaw in the Linux kernel IPv4 IGMP implementation, in `ip_check_mc_rcu` within `net/ipv4/igmp.c`. Improper locking allows a local low-privileged user to race repeated opening and closing of IGMP inet sockets, potentially causing a kernel crash or escalating privileges; Android tracked the issue as **A-112551163**. Red Hat rated the vulnerability Moderate with a CVSS v3.1 score of 7.0, noting that reliable exploitation has high complexity and that no reproducer was known. Fixes were released for Red Hat Enterprise Linux 8 and 9, including real-time kernel packages, and Fedora incorporated fixes in stable kernel 5.13.16 updates; RHEL 6 was not affected and RHEL 7 was outside support scope.
Aug 26, 2026