Loading story…
Red Hat released Important kernel security updates for multiple RHEL 8.6 and RHEL 9.0 service variants to address several Linux kernel flaws, including CVE-2026-46333, which lets an unprivileged local user read root-owned files. The bug stems from a race during process exit in kernels before commit 31e62c2ebbfd, where __ptrace_may_access() can skip a dumpable check when task->mm is NULL, allowing pidfd_getfd(2) to obtain file descriptors from a exiting process that still has accessible files. Qualys reported the issue, and Linus Torvalds merged the upstream fix in May 2026.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:24814, an Important security advisory for the kpatch-patch package covering RHEL 9.4 Extended Update Support and related service variants. The live patch update remediates CVE-2026-46333 without requiring a reboot and also addresses CVE-2026-46300.
Red Hat issued RHSA-2026:23469, an Important security advisory for kpatch live patch packages affecting RHEL 9.2 Update Services for SAP Solutions, AUS, and Extended Life Cycle offerings. The live patch update remediates CVE-2026-46333 along with CVE-2026-46300 across x86_64 and ppc64le package variants without requiring a kernel reboot.
Red Hat issued RHSA-2026:23471, an Important security advisory for kpatch live patch packages affecting RHEL 8.8 Update Services for SAP Solutions and related 8.8 offerings. The live patch update remediates CVE-2026-46333 along with CVE-2026-46300 across x86_64 and ppc64le package variants without requiring a kernel reboot.
Red Hat issued RHSA-2026:20129, an Important kernel security update for RHEL 9.6 Extended Update Support and related service channels. The advisory fixes CVE-2026-46333 along with CVE-2026-46300 across multiple architectures and instructs administrators to reboot after applying the update.
Red Hat issued RHSA-2026:20054, an Important kernel security update for RHEL 9.4 Extended Update Support and related 9.4 channels. The advisory fixes CVE-2026-46333 along with CVE-2026-46300 and instructs administrators to apply the update and reboot affected systems.
Red Hat issued RHSA-2026:20051, an Important kernel security update for RHEL 8.6 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. The advisory fixes CVE-2026-46333 and tells administrators to reboot affected systems after applying the update.
Red Hat issued RHSA-2026:19705, an Important kernel security update for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The advisory includes fixes for CVE-2026-46333 along with other kernel vulnerabilities and instructs administrators to reboot after installation.
Linus Torvalds fixed the Linux kernel flaw that lets an unprivileged user read root-owned files by exploiting a race during process exit. The Bugzilla entry states all stable kernels were affected as of that date prior to commit 31e62c2ebbfd.
The file-descriptor theft pattern underlying the later kernel issue was previously identified by Jann Horn in October 2020.
Red Hat's Bugzilla entry documents CVE-2026-46333 as a Linux kernel vulnerability that allows an unprivileged user to read root-owned files via pidfd_getfd during process exit. It credits Qualys with reporting the issue and notes multiple RHEL product variants were addressed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
Red Hat released a series of **Moderate-severity** kernel and `kernel-rt` security advisories across multiple Red Hat Enterprise Linux product lines, including RHEL 9.0, 9.2, 9.4 EUS, 9.6 EUS, RHEL 10, RHEL 10.0 EUS, and RHEL 7 ELS. The updates address several Linux kernel vulnerabilities tied to **use-after-free**, **double-free**, **memory leak**, **race condition**, **denial-of-service**, and **privilege-escalation** conditions. Repeatedly cited issues include `CVE-2026-23171` in the bonding module, which can cause a system crash or arbitrary code execution, `CVE-2026-23231` in `nf_tables_addchain()`, which can enable privilege escalation or denial of service, and `CVE-2026-23204` in `net/sched cls_u32`. Red Hat also highlighted `CVE-2026-23001`, a macvlan use-after-free in `macvlan_forward_source()`, with Bugzilla detailing an upstream fix that adds **RCU protection** so entries queued for freeing are skipped safely. That flaw, along with related macvlan issues such as `CVE-2026-23209`, was included in updates for several RHEL branches and SAP-related offerings. Advisories consistently state that affected systems must be **rebooted** after applying the updated kernel packages for the fixes to take effect.
Sep 4, 2026
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026