Loading story…
CVE-2022-50000 is a Linux kernel Netfilter flowtable cleanup flaw that can trigger a use-after-free when hardware-offload statistics or flow-add work remains pending during flowtable teardown. The race can defer hardware deletion work until after the flowtable has been freed, allowing the flow-offload work handler to access freed memory. The affected code was introduced in Linux kernel 5.5; upstream fixes are available in 5.15.64, 5.19.6, and 6.0 and later stable releases.
The fix flushes outstanding work before teardown, marks flows for removal, forces garbage-collection passes to queue and complete hardware flow-deletion work, and removes software flowtable entries only afterward. Red Hat rates the issue Moderate with CVSS v3 7.0 and lists fixes for affected RHEL 8 packages, including RHEL 8.4 Advanced Mission Critical Update Support and the 8.4 Extended Update Support Long-Life Add-On through RHSA-2025:15660; organizations should deploy current vendor-supported kernel updates rather than cherry-picking the patch.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Greg Kroah-Hartman published the Linux kernel CVE announcement describing a netfilter flowtable use-after-free caused by pending hardware offload work and recommending updates to current stable kernel releases.
Red Hat released RHSA-2023:0101 with fixed RHEL 8 kernel packages for CVE-2022-50000.
Red Hat listed the vulnerable code as absent from RHEL 9 in RHSA-2022:8267.
RHSA-2025:15660 addressed CVE-2022-50000 for RHEL 8.4 Advanced Mission Critical Update Support and RHEL 8.4 Extended Update Support Long-Life Add-On.
Red Hat made its CVE record for the netfilter flowtable cleanup vulnerability public, rating it Moderate with a CVSS v3 score of 7.0.
RHSA-2023:2951 delivered additional fixed RHEL 8 kernel packages for the vulnerability.
Red Hat issued RHSA-2023:0512, providing a kernel fix for RHEL 9.0 Extended Update Support.
The issue was fixed in Linux kernel versions 5.15.64, 5.19.6, and 6.0. The changes flush pending offload work, queue and flush hardware-removal work, and remove software flow entries before freeing the flowtable.
The vulnerable flowtable cleanup behavior was introduced in Linux kernel 5.5 by commit c29f74e0df7a02b8303bcdce93a7c0132d62577a.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-27397** is a use-after-free flaw in the Linux kernel's `netfilter`/`nf_tables` subsystem. During control-plane transactions, a set element with a timeout could expire before the transaction completed because affected set backends did not use a transaction-start timestamp. A local low-privileged attacker could potentially crash an affected host or elevate privileges; the vulnerability affects code introduced in Linux kernel 4.1. The issue is fixed in Linux kernel 6.7.5, 6.8, and later stable releases. Red Hat issued corrected `kernel` and `kernel-rt` packages for multiple RHEL 8 and 9 streams and rates the flaw Moderate, while CVSS assessments range from 7.0 to 7.8 depending on assumed attack complexity. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; non-containerized RHEL 8 systems may temporarily disable user namespaces, but this mitigation must not be used on OpenShift because its containers require user namespaces.
Aug 26, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026
Red Hat issued fixes for **CVE-2022-48754**, a use-after-free flaw in the Linux kernel's `phylib` networking subsystem. The vulnerability occurs in `phy_detach()` because `phy_device_reset()` was called after `put_device()`, which may already have released the PHY device. The upstream correction moves the reset operation before `put_device()`. The flaw was introduced in Linux 4.16 and corrected in upstream stable releases including 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17. Red Hat delivered fixes for RHEL 8 kernel, kernel-rt, and RHEL 8.8 Extended Update Support through advisories including **RHSA-2024:6206**, **RHSA-2024:7000**, and **RHSA-2024:7001**; Red Hat listed RHEL 9 kernel and kernel-rt as affected at publication. Red Hat rated the issue Low severity with CVSS 5.6, while the CVE record carried a 7.8 score.
Aug 26, 2026