Loading story…
CVE-2024-38586 affects the Linux kernel's r8169 network driver: transmitting small fragmented packets can insert invalid descriptors into the transmit ring buffer and lead to dma_unmap_single() being called with a null address. The flaw is categorized as CWE-457, use of an uninitialized variable, and can cause kernel instability or denial of service; NVD scored it 7.8 CVSS v3.1, while Red Hat rated it Moderate with a 4.1 score.
Upstream fixes are available in Linux kernel versions 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3, and 6.10-rc1. Red Hat issued kernel updates for affected RHEL 8 and RHEL 9 streams, including applicable extended-support and specialized variants; RHEL 6 is not affected. Organizations running systems with Realtek r8169 adapters should apply their vendor-provided kernel updates and reboot into the patched kernel.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:8856 for the RHEL 8 kernel and RHSA-2024:8870 for the RHEL 8 kernel-rt stream to address CVE-2024-38586.
Red Hat released RHSA-2024:6297 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat addressed CVE-2024-38586 in the RHEL 8.8 Extended Update Support kernel through RHSA-2024:6206.
Red Hat released RHSA-2024:5364 and RHSA-2024:5365 to fix CVE-2024-38586 in the RHEL 9.2 Extended Update Support kernel and kernel-rt streams.
Red Hat addressed CVE-2024-38586 for Red Hat Enterprise Linux 9 through advisory RHSA-2024:4583.
Patrick Del Bello reported the Linux kernel r8169 issue that can cause ring-buffer corruption while processing fragmented transmit packets.
Red Hat published its record for CVE-2024-38586, covering a Linux kernel r8169 driver flaw involving transmit-ring corruption on fragmented packets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-39973** affects the Linux kernel’s Intel i40e Ethernet driver: a malicious virtual function can provide an oversized or misaligned `ring_len` value that is passed to a hardware memory context without adequate validation. The condition can create excessive transmit or receive queue lengths, potentially resulting in memory corruption or undefined behavior. Red Hat rates the issue Moderate with a CVSS v3.1 score of 7.5, while CVE.org assigns 8.8 under different environmental assumptions; RHEL 7 through 10, including applicable real-time kernels, are listed as affected, while RHEL 6 is not affected. The defect aligns with **CWE-131**, incorrect calculation of buffer size, a memory-safety weakness that can lead to out-of-bounds access, crashes, sensitive-data exposure, or code execution. Red Hat’s RHSA-2025:21469 provides updated RHEL 9 kernel packages for multiple kernel security issues and requires a reboot after installation; however, Red Hat’s CVE record separately reports no qualifying mitigation for CVE-2025-39973. Organizations should identify systems using affected i40e hardware and virtual-function configurations, apply applicable vendor kernel updates, reboot hosts, and restrict untrusted VF access where operationally possible.
Aug 25, 2026
CVE-2024-26638 is a low-severity flaw in the Linux kernel's Network Block Device (NBD) driver, introduced in kernel version 5.19. Incomplete initialization of a `struct msghdr` in the NBD reply-receive path can expose the uninitialized `msg_get_inq` field during `tcp_recvmsg` processing, triggering a KMSAN uninitialized-value error and affecting system availability. Exploitation requires local access and high privileges; Red Hat assigns a CVSS 3.1 score of 4.4. The upstream issue is fixed in Linux 6.1.76, 6.6.15, 6.7.3, 6.8, and later stable releases. Red Hat has issued fixes for affected Red Hat Enterprise Linux 8, RHEL 9, and RHEL 9.4 Extended Update Support packages, while RHEL 8 and RHEL 9 real-time kernels remain affected; unsupported RHEL 6 and 7 variants should be considered potentially affected. Organizations should update to vendor-supported current kernel releases rather than cherry-picking the individual upstream patch.
Aug 26, 2026
**CVE-2023-45871** is an Important-rated buffer overflow in the Linux kernel’s Intel IGB Ethernet driver. When `rx-all`/store-bad-packet behavior is enabled, an oversized physical-layer frame can overflow a receive-ring buffer in `igb_configure_rx_ring`, potentially compromising system confidentiality, integrity, and availability. Red Hat assigned the flaw a CVSS v3.1 score of 7.5; exploitation requires an adjacent-network attacker and is considered high complexity because it depends on oversized frames and a non-default configuration. The upstream kernel fix updates `igb_set_rx_buffer_len` to allocate large receive buffers on systems with page sizes below 8192 bytes when either frames exceed `IGB_MAX_FRAME_BUILD_SKB` or the `E1000_RCTL_SBP` receive-control flag is set. Red Hat released corrected kernel, `kernel-rt`, and `kpatch` packages for affected Red Hat Enterprise Linux 7 and 8 streams in February and March 2024, with no qualifying mitigation listed at the time of its advisory.
Aug 26, 2026