Loading story…
Upstream Linux kernel fixes address three iSCSI initiator vulnerabilities reported by Adam Nichols: CVE-2021-27363, CVE-2021-27364, and CVE-2021-27365. An unprivileged local user could access an iSCSI transport handle, connect to the iSCSI Netlink socket, and issue kernel commands; chaining the first two flaws could allow arbitrary termination of iSCSI sessions. Separately, oversized negotiated initiator or target parameters displayed through a 4 KB-limited sysfs interface could leak kernel memory.
The kernel hardening patch adds CAP_SYS_ADMIN checks in drivers/scsi/scsi_transport_iscsi.c. Non-administrative processes are now denied access to the transport-handle sysfs attribute, and the iSCSI Netlink receiver rejects messages from senders lacking administrative capability, preventing unprivileged manipulation of iSCSI transport operations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Marcus Meissner announced upstream Linux kernel security fixes for CVE-2021-27363, CVE-2021-27364, and CVE-2021-27365, all reported by Adam Nichols. The flaws enabled iSCSI memory disclosure via oversized sysfs parameters and, when two issues were chained, arbitrary termination of iSCSI sessions by a non-root local attacker.
The Linux kernel iSCSI transport code was changed to require CAP_SYS_ADMIN for reading transport handles through sysfs and for processing iSCSI netlink messages, preventing unprivileged manipulation of iSCSI operations. The patch addresses CVE-2021-27363 and CVE-2021-27364.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat addressed **CVE-2020-36516**, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel `5.17-rc2`. The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through **RHSA-2024:2674** for RHEL 8.6 extended-support channels. That advisory also remediates `CVE-2024-26586` in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
Aug 26, 2026
Researchers disclosed multiple Linux kernel memory-corruption vulnerabilities affecting network-facing components, including a **remote heap overflow** in the Transparent Inter Process Communication (**TIPC**) module tracked as `CVE-2021-43267`, and a later packet-socket flaw, `CVE-2025-38617`, that was shown to be exploitable through a race condition. The TIPC issue exposed systems running the module to potential **arbitrary code execution in kernel context**, highlighting the risk posed by rarely used but reachable networking features in default or enterprise Linux deployments. Additional advisory coverage from the Zero Day Initiative underscored continued security concerns around Linux kernel bug classes such as heap overflows and race conditions, which can be leveraged for **privilege escalation** or full system compromise depending on exposure and configuration. Together, the reports show that flaws in low-level packet handling and inter-process communication paths remain a high-impact attack surface, especially where vulnerable kernel modules are enabled or accessible to untrusted users or networks.
Jun 29, 2026
A flaw tracked as **CVE-2026-43158** in the Linux kernel's **XFS** filesystem can let a local user trigger a denial of service by causing an assertion failure and filesystem shutdown. The bug affects XFS attribute leaf block handling during repeated `setxattr` operations: crafted extended attribute insertions can corrupt freemap accounting so that the entries array overlaps free space. The issue is classified as **CWE-617 Reachable Assertion**, carries a **CVSS v3 score of 7.0** from Red Hat, and traces back to code introduced in Linux `2.6.12`. The Linux kernel community published fixes across multiple stable branches, with maintainers advising organizations to update to current stable kernels rather than cherry-pick patches. Red Hat said no acceptable mitigation is available and shipped fixes through updated **RHEL** kernel packages and errata, including advisory **RHSA-2026:27735** for **RHEL 9.4 Update Services for SAP Solutions** and related variants. That advisory bundles **CVE-2026-43158** with other kernel vulnerabilities in components including **libceph**, **netfilter**, **SMB/CIFS**, **SCTP**, and **mac80211**, and requires affected systems to be rebooted after installation.
Aug 25, 2026