Loading story…
A flaw in the Linux kernel's SELinux netlink send hook allowed processes to evade required SELinux access checks when multiple netlink messages were bundled into one socket buffer. selinux_netlink_send() examined only the first message, potentially allowing subsequent messages to be transmitted without their message-type permission checks; the behavior differed from systems with SELinux disabled.
The corrective kernel patch iterates through every netlink message in the buffer, validates message lengths, and performs a SELinux permission lookup for each message before allowing transmission. Messages requiring permissions that fail validation are denied; unknown message mappings continue to be logged and are denied when SELinux is enforcing unless unknown permissions are permitted. The fix was prepared for upstream inclusion in the Linux v5.7 release cycle.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Paul Moore disclosed the SELinux/netlink missing-access-check issue to the oss-security mailing list. A corrective patch had been posted to the SELinux mailing list and was expected to be submitted for an upcoming Linux v5.7 release candidate.
Dmitry Vyukov reported that selinux_netlink_send() failed to properly handle multiple netlink messages in a socket buffer, resulting in a missing SELinux access check for the affected case.
A Linux kernel patch changed selinux_netlink_send() to iterate through all complete netlink messages in an skb and perform SELinux permission lookup and enforcement for each message. It also added message-length validation and retained conditional handling for unknown message mappings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2022-36946** is a Linux kernel Netfilter `nfnetlink_queue` flaw in `nfqnl_mangle()` that allows a user able to create Netfilter rules to truncate a queued packet below its required transport-header offset. Processing an `NFQNL_MSG_VERDICT` with an invalidly short `NFA_PAYLOAD` can create a malformed socket buffer; subsequent IPv4 or IPv6 header handling can then panic the kernel and deny service. A one-byte payload was reported as sufficient to trigger the condition. Upstream fixed the issue in Linux kernel `5.18.16` by enforcing a minimum packet length and returning `-EINVAL` for invalid truncation requests. Red Hat rated the locally initiated issue Moderate (CVSS 6.2) and released fixes for affected RHEL 8, RHEL 9, RHEL 8.6 EUS, and Red Hat Virtualization 4 packages; organizations unable to patch can mitigate exposure by preventing the `nfnetlink_queue` kernel module from loading.
Aug 26, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026
A **Linux kernel** flaw tracked as `CVE-2026-31684` was disclosed in the network scheduler's `act_csum` code, where improperly validated **nested VLAN headers** can trigger an out-of-bounds read. The bug affects `tcf_csum_act()` in `net/sched/act_csum.c`, which may access `h_vlan_encapsulated_proto` and pull `VLAN_HLEN` bytes from `skb->data` before confirming the full VLAN header is present in the linear buffer, breaking `skb` invariants and potentially crashing the system. The issue was introduced in kernel `5.1`, with an additional affected introduction point noted in `4.19.99`, and has been fixed upstream in `6.12.83`, `6.18.24`, `6.19.14`, and `7.0`. Red Hat rated the vulnerability **Moderate** with a `CVSS v3` score of **7.1** and published fixes for multiple **Red Hat Enterprise Linux** kernel packages across **RHEL 7, 8, and 10** through security errata; the Linux kernel CVE team advised users to update to the latest stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026