Loading story…
CVE-2023-6610 is an out-of-bounds read in the Linux kernel SMB client’s smb2_dump_detail function in fs/smb/client/smb2ops.c. A local low-privileged attacker can trigger the flaw without user interaction, potentially causing a system crash or disclosing internal kernel memory. The issue is tracked in the Linux kernel Bugzilla as 218219 and is categorized as CWE-125.
Red Hat rated the vulnerability 7.1 CVSS v3.1 and released fixes for affected Red Hat Enterprise Linux 8 and 9 kernel packages, related Extended Update Support releases, Red Hat Virtualization 4 for RHEL 8, and identified affected OpenShift Logging components. Organizations should apply vendor kernel updates; where patching cannot occur immediately, Red Hat recommends preventing the cifs kernel module from loading.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:0881 and RHSA-2024:0897 to fix CVE-2023-6610 in the RHEL 8 kernel-rt and standard kernel packages.
Red Hat released fixes for RHEL 8.6 EUS, RHEL 9.2 EUS, and RHEL 9.2 EUS kernel-rt through RHSA-2024:0724, RHSA-2024:0723, and RHSA-2024:0725. RHSA-2024:0724 also fixed Red Hat Virtualization 4 for RHEL 8.
Red Hat published the record for CVE-2023-6610, an out-of-bounds read flaw in the Linux kernel SMB client’s smb2_dump_detail function.
Red Hat released RHSA-2024:2094 to fix affected RHOL-5.8-RHEL-9 cluster-logging-operator-bundle and cluster-logging-rhel9-operator components.
Red Hat released RHSA-2024:1404 to address CVE-2023-6610 in the RHEL 8.8 Extended Update Support kernel.
Red Hat released RHSA-2024:1248, addressing CVE-2023-6610 in the RHEL 9 kernel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat disclosed two **Important** Linux kernel vulnerabilities in the SMB client’s `cifsacl` handling that can be triggered by a malicious SMB server and lead to memory corruption. **`CVE-2026-31709`** affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of **7.8**. A second flaw, **`CVE-2026-46195`**, affects **32-bit** Red Hat Enterprise Linux systems and stems from a crafted `dacloffset` value that can trigger pointer wrap during `chmod` or `chown` operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it **7.5**, and mapped it to **`CWE-787`**, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the `cifs` kernel module as a mitigation.
Aug 25, 2026
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026
A flaw in the Linux kernel's netfilter `xt_tcpmss` module, tracked as **`CVE-2026-43190`**, allows a remote attacker to trigger a one-byte out-of-bounds read with a specially crafted TCP packet. The bug is caused by improper validation of the remaining TCP option length before reading the option-length byte, and it can lead primarily to information disclosure with possible limited availability impact. The issue is not broadly reachable across all Linux systems; it affects hosts whose firewall rulesets use the `tcpmss` match. The Linux kernel CVE team published fixes across multiple stable branches, including **5.10.252**, **5.15.202**, **6.1.165**, **6.6.128**, **6.12.75**, **6.18.16**, **6.19.6**, and **7.0**, and advised users to move to the latest stable kernel releases. Red Hat later shipped the fix in **RHSA-2026:44694** for **Red Hat Enterprise Linux 10.0 Extended Update Support** kernel packages, alongside fixes for **`CVE-2026-31684`** and **`CVE-2026-46152`**; updated packages include kernel version **`6.12.0-55.92.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, and Red Hat said affected systems should be rebooted after installation.
Aug 25, 2026