Loading story…
Researchers Moshe Kol, Amit Klein, and Yossi Gilad demonstrated that Linux systems using the pre-5.18 TCP source-port selection algorithm could be remotely fingerprinted by a hostile website. By inducing and detecting collisions in a per-device-keyed, 256-entry source-port counter table, an attacker could derive a persistent per-boot identifier in roughly 10,000 connection attempts and about ten seconds. The identifier could link activity across browsers, private-browsing sessions, websites, containers, IPv4/IPv6 networks, and in some cases VPNs.
The tracking identifier generally persisted until reboot, while NAT port rewriting and Tor could limit the technique. Following coordinated disclosure, Linux 5.18 added mitigations: time-varying hash input, randomized counter increments, and expansion of the counter table to 65,536 entries, making collision discovery and practical remote fingerprinting substantially harder.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Moshe Kol, Amit Klein, and Yossi Gilad submitted research describing how hash collisions in Linux's TCP source-port selection can generate a per-boot device identifier. They reported that a hostile website could use the technique to track affected Linux devices across browsers, privacy modes, containers, and some network configurations.
The Linux kernel team introduced a security patch mitigating the tracking technique. The fixes added time-varying hash input, randomized counter increments, and expanded the counter table to 65,536 entries; the patch set was merged into Linux 5.18 at release candidate 6.
A patch set to address the TCP source-port fingerprinting issue was initially posted without a public explanation, which was delayed due to the research paper's publication requirements.
A patch by Eric Dumazet introduced the affected TCP source-port selection mechanism in Linux kernel 5.12. The pre-fix design used a 256-entry counter table and a boot-time random key in its hash calculation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
lwn.net
Open sourcearxiv.org
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2020-36516**, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel `5.17-rc2`. The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through **RHSA-2024:2674** for RHEL 8.6 extended-support channels. That advisory also remediates `CVE-2024-26586` in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
Aug 26, 2026
Researchers disclosed **CVE-2024-36904**, a seven-year-old race condition in the Linux kernel TCP subsystem that can lead to a real use-after-free involving `TIME-WAIT` sockets. The flaw was introduced by commit `ec94c2696f0b`, which changed `inet_twsk_hashdance()` so a socket could be inserted into the established hash table before its reference counter was initialized, allowing concurrent code in paths such as `tcp_twsk_unique()` and `__inet_check_established()` to observe a zero refcount and corrupt socket lifetime handling. The issue was first encountered while investigating a syzkaller report that appeared tied to KCM, but researchers determined it was unrelated and reproducible even with `CONFIG_AF_KCM` disabled. Allele Security reproduced the bug on a RHEL-derived `5.14.0-362.24.2.el9_3.x86_64` kernel and on Fedora 39 `6.8.6-200.fc39.x86_64`, where it initially manifested as refcount warnings. The researchers said Linux refcount protections usually degrade such races into leaks, but in this case a later `refcount_set()` could overwrite the saturated value and create an unbalanced reference count, enabling premature free; with a modified KASAN-enabled research kernel, they obtained an actual use-after-free report in `inet_twsk_put()`. Upstream addressed the flaw in commit `f2db7230f73a` by changing `tcp_twsk_unique()` to use `refcount_inc_not_zero()` before taking a reference to the `TIME-WAIT` socket.
Aug 20, 2026
Researchers reported that newer variants of **Linux/Moose** continue to infect Linux-based consumer routers and other embedded Linux devices, where the malware steals unencrypted network traffic, harvests HTTP cookies, and abuses compromised systems as proxies to generate fraudulent social-media activity such as fake follows, views, and likes. The malware remains memory-resident, so a reboot stops execution, but it still propagates through Telnet credential brute-forcing against exposed devices. The updated variants changed several operational details to hinder detection and analysis. Instead of embedding the command-and-control IP address directly in the binary, operators now pass it as an encrypted command-line argument, and the malware’s communications shifted from a binary protocol to an ASCII-printable format carried in HTTP headers. Researchers also observed a proxy listener change from TCP port `10073` to TCP port `20012`, along with reduced password and whitelist lists compared with earlier versions, and published indicators of compromise including sample hashes, primary C2 infrastructure, and whitelist IP addresses.
Aug 14, 2026