widely-deployed-product-advisoryendpoint-software-vulnerability

Red Hat RHEL 9 Kernel Updates Fix TCP Fast Open and qla2xxx Use-After-Free Flaws

Patch & Detection Intelligence · 27 sources · Updated 2mo ago · First seen Dec 22, 2025

Red Hat released Important-security-impact kernel updates for RHEL 9.0 Update Services for SAP Solutions, addressing five kernel vulnerabilities in the qla2xxx SCSI driver, TCP Fast Open (TFO), cfg80211 Wi-Fi handling, and Network Block Device ioctl validation. The updates include CVE-2023-53322, a qla2xxx use-after-free condition in which terminate_rport_io() may return before outstanding FCP-2 I/O completes, potentially causing a system crash, and CVE-2025-40186, a TFO request-path refcount underflow/use-after-free caused by duplicate removal of a request socket while a listening socket is closed.

RHSA-2025:23424 supplies kernel-rt-5.14.0-70.158.1.rt21.230.el9_0 for x86_64 RHEL 9.0 SAP Solutions real-time deployments, while RHSA-2025:23426 provides kernel-5.14.0-70.158.1.el9_0 for affected x86_64, ppc64le, and specified aarch64 and s390x offerings. Organizations should install the applicable kernel packages and reboot affected systems to activate the fixes; no qualifying mitigation was listed for CVE-2023-53322.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

27 events · Apr 7, 2022 – Dec 22, 2025

Reported Dec 22, 202511mo ago
Red Hat releases RHEL 8.2 kernel fix
Red Hat issued RHSA-2026:0643 to remediate CVE-2023-53322 for RHEL 8.2 Advanced Update Support.
CVE-2023-53322 - Red Hat Customer Portal
Reported Dec 22, 202511mo ago
Red Hat releases RHEL 8.6 kernel fix
Red Hat issued RHSA-2026:0536 to remediate CVE-2023-53322 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
CVE-2023-53322 - Red Hat Customer Portal
Dec 22, 202511mo ago
Red Hat fixes qla2xxx flaw in RHEL 7 extended support
Red Hat issued RHSA-2025:23947 and RHSA-2025:23960 to fix CVE-2023-53322 in the kernel and kernel-rt packages for RHEL 7 Extended Lifecycle Support.
CVE-2023-53322 - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat releases RHEL 9.4 extended-support kernel update
Red Hat issued Important-rated RHSA-2025:23450 for RHEL 9.4 Extended Update Support and associated channels. Kernel version 5.14.0-427.103.1.el9_4 fixes CVE-2025-39864, CVE-2025-39955, and CVE-2025-40186; affected systems require a reboot.
RHSA-2025:23450 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat issues RHEL 9.0 kernel security update
Red Hat issued Important-rated RHSA-2025:23426 for RHEL 9.0 Update Services for SAP Solutions. The update provides kernel 5.14.0-70.158.1.el9_0 packages that remediate CVE-2023-53322 and CVE-2025-40186 and requires a reboot.
RHSA-2025:23426 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat issues RHEL 9.0 real-time kernel security update
Red Hat issued Important-rated RHSA-2025:23424 for RHEL 9.0 Update Services for SAP Solutions. The kernel-rt update fixes CVE-2023-53322 and CVE-2025-40186, among other kernel vulnerabilities, and requires a reboot.
RHSA-2025:23424 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat releases RHEL 8.4 extended-support kernel fix
Red Hat issued RHSA-2025:23463 to remediate CVE-2023-53322 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
CVE-2023-53322 - Red Hat Customer Portal
Nov 25, 20251y ago
Red Hat releases RHEL 8.8 telecommunications kernel fix
Red Hat issued RHSA-2025:22072 to fix CVE-2023-53322 in the RHEL 8.8 Telecommunications Update Service kernel.
CVE-2023-53322 - Red Hat Customer Portal
Sep 16, 20251y ago
Red Hat publishes CVE-2023-53322 record
Red Hat published its CVE record for CVE-2023-53322, documenting the qla2xxx terminate_rport_io() use-after-free vulnerability.
CVE-2023-53322 - Red Hat Customer Portal
Reported Aug 25, 20251y ago
Red Hat documents and fixes UDP memory-accounting flaw
Red Hat documented CVE-2025-22058, an integer-overflow flaw in the Linux kernel's UDP receive-memory accounting that can cause inflated accounting, packet drops, and denial of service. Red Hat issued fixes for affected RHEL 8, RHEL 9, and RHEL 10 product streams.
2360276 - (CVE-2025-22058) CVE-2025-22058 kernel: udp: Fix memory accounting leak.
Jul 14, 20251y ago
Red Hat issues RHEL 9.0 kernel update fixing ten CVEs
Red Hat issued Important-rated RHSA-2025:10830 for RHEL 9.0 Update Services for SAP Solutions, providing kernel version 5.14.0-70.138.1.el9_0. The update fixes ten kernel vulnerabilities, including flaws in UML, device mapper, IPv6 multicast, Squashfs, ATM LEC, ext4, UDF, and the Atlantic driver; systems must be rebooted after installation.
RHSA-2025:10830 - Security Advisory - Red Hat Customer Portal
May 22, 20242y ago
Red Hat fixes qla2xxx flaw in RHEL 8
Red Hat issued RHSA-2024:3138, updating the RHEL 8 kernel to remediate CVE-2023-53322, a use-after-free issue in the qla2xxx SCSI driver.
CVE-2023-53322 - Red Hat Customer Portal
Jan 24, 20243y ago
Red Hat releases RHEL 8.6 kernel security update
Red Hat issued Important-rated RHSA-2024:0412 for RHEL 8.6 Extended Update Support and associated channels, providing kernel version 4.18.0-372.87.1.el8_6. The update remediates numerous kernel flaws, including CVE-2023-2513 and CVE-2023-3772, and requires a reboot after installation.
RHSA-2024:0412 - Security Advisory - Red Hat Customer Portal
Reported Nov 15, 20233y ago
Red Hat documents and fixes ext4 use-after-free flaw
Red Hat documented CVE-2023-2513, a use-after-free vulnerability in Linux ext4 extended-attribute handling caused by integer underflow or overflow in extra inode-size offset calculations. The upstream fix was included in Linux 6.0-rc1, and Red Hat distributed fixes through kernel and kernel-rt errata for affected RHEL 8 and RHEL 9 streams.
2193097 - (CVE-2023-2513) CVE-2023-2513 kernel: ext4: use-after-free in ext4_xattr_set_entry()
Nov 14, 20233y ago
Red Hat releases RHEL 8 kernel update fixing ext4 flaw
Red Hat issued Important-rated RHSA-2023:7077 for RHEL 8, providing kernel 4.18.0-513.5.1.el8_9. The update remediated CVE-2023-2513 in ext4 extended-attribute handling along with numerous other kernel vulnerabilities; systems require a reboot after installation.
RHSA-2023:7077 - Security Advisory - Red Hat Customer Portal
Reported Nov 9, 20233y ago
Red Hat documents and fixes exFAT stack-overflow flaw
Red Hat documented CVE-2023-4273, a stack overflow in the Linux exFAT driver's filename reconstruction logic that malformed directory entries can trigger. The issue was fixed upstream in commit d42334578eba1390859012ebb91e1e556d51db49 and addressed for RHEL 9 through RHSA-2023:6583.
2221609 - (CVE-2023-4273) CVE-2023-4273 kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry
Jun 30, 20233y ago
Researcher reports XFRM NULL-pointer denial-of-service flaw
Guilherme de Almeida Suckevicz reported CVE-2023-3772, in which a local user with CAP_NET_ADMIN can trigger a NULL-pointer dereference in xfrm_update_ae_params() and panic the Linux kernel. The flaw stems from use of unallocated XFRM replay-state pointers.
2218943 - (CVE-2023-3772) CVE-2023-3772 kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()
Jun 16, 20233y ago
Rohit Keshri reports relayfs out-of-bounds flaw
Rohit Keshri reported CVE-2023-3268, a medium-severity out-of-bounds memory-access vulnerability in the Linux kernel relayfs function relay_file_read_start_pos. A local attacker could crash an affected system or disclose internal kernel information; the issue was fixed upstream in Linux 6.4-rc1.
2215502 - (CVE-2023-3268) CVE-2023-3268 kernel: out-of-bounds access in relay_file_read
Jun 8, 20233y ago
Mauro Cascella reports fbcon shift-out-of-bounds flaw
Mauro Matteo Cascella reported CVE-2023-3161, a medium-severity shift-out-of-bounds flaw in the Linux Framebuffer Console's fbcon_set_font() function. Supplying font width or height values greater than 32 bypassed missing bounds checks, causing undefined behavior that could lead to denial of service.
2213485 - (CVE-2023-3161) CVE-2023-3161 kernel: fbcon: shift-out-of-bounds in fbcon_set_font()
Reported May 16, 20233y ago
Red Hat documents and fixes CBQ classifier out-of-bounds flaw
Red Hat documented CVE-2023-23454, an out-of-bounds read in the Linux CBQ traffic-control classifier's cbq_classify function caused by type confusion in classification-result handling. The flaw can allow a local attacker to cause denial of service; Red Hat addressed it in RHEL 8 advisories RHSA-2023:2736 and RHSA-2023:2951 and in RHEL 8.6 EUS through RHSA-2024:0412.
2168297 - (CVE-2023-23454) CVE-2023-23454 kernel: slab-out-of-bounds read vulnerabilities in cbq_classify
May 9, 20234y ago
Red Hat releases RHEL 9 fixes for ext4 use-after-free flaw
Red Hat released RHSA-2023:2458 for the RHEL 9 kernel and RHSA-2023:2148 for the RHEL 9 kernel-rt package, remediating CVE-2023-2513, an ext4 extended-attribute use-after-free vulnerability.
CVE-2023-2513 - Red Hat Customer Portal
Apr 20, 20234y ago
Mauro Cascella reports SLIMpro I2C out-of-bounds write flaw
Mauro Matteo Cascella reported CVE-2023-2194, a medium-severity out-of-bounds write in the Linux SLIMpro I2C driver's xgene_slimpro_i2c_xfer() path. An insufficiently validated user-controlled data->block[0] value can cause an out-of-bounds memcpy operation in slimpro_i2c_blkwr.
2188396 - (CVE-2023-2194) CVE-2023-2194 kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
Feb 26, 20234y ago
CVE-2023-1074 SCTP type-confusion flaw reported
CVE-2023-1074 was reported in the Linux kernel SCTP diagnostic code. An empty SCTP association bound-address list can cause inet_diag_msg_sctpasoc_fill() to invoke list_entry() on an invalid list element, creating a type-confused pointer that may return information to userspace.
2173430 - (CVE-2023-1074) CVE-2023-1074 kernel: sctp: fail if no bound addresses can be used for a given scope
Feb 26, 20234y ago
CVE-2023-1079 reported in Linux HID Asus driver
CVE-2023-1079, a medium-severity use-after-free flaw in the Linux HID Asus keyboard-backlight handling path, was reported. A malicious USB device impersonating an Asus device could trigger scheduled LED-controller work to access freed memory during connection or disconnection.
2173444 - (CVE-2023-1079) CVE-2023-1079 kernel: hid: Use After Free in asus_remove()
Reported Nov 15, 20224y ago
Red Hat closes tracking bug for ath9k HTC use-after-free flaw
Red Hat closed its tracking bug for CVE-2022-1679, a use-after-free in the Linux ath9k HTC wireless driver's ath9k_htc_probe_device() failure path. A stale driver-private pointer can be dereferenced during USB receive-stream processing, potentially allowing local kernel-memory access, crashes, or information disclosure.
2084125 - (CVE-2022-1679) CVE-2022-1679 kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges
Oct 18, 20224y ago
Linux kernel qdisc_graft use-after-free flaw reported
A Linux kernel mailing-list reference documented CVE-2023-0590, a use-after-free vulnerability caused by a race condition in qdisc_graft() in net/sched/sch_api.c. The flaw can cause denial of service; a syzkaller-triggered KASAN report showed a use-after-free read in __tcf_qdisc_find during traffic-control filter handling.
2165741 - (CVE-2023-0590) CVE-2023-0590 kernel: use-after-free due to race condition in qdisc_graft()
Apr 7, 20225y ago
Marian Rehak reports CAN-over-USB double-free flaw
Marian Rehak reported CVE-2022-28388, a double-free vulnerability in the Linux kernel's CAN-over-USB usb_8dev_start_xmit function. The issue affected kernel versions through 5.17.1 and was later fixed upstream in commit 3d3925ff6433f98992685a9679613a2cc97f3ce2.
2073091 - (CVE-2022-28388) CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

5 linked

Linux Kernel TCP Fast Open Request Socket Double Free (CVE-2025-40186)Use-after-free in Linux kernel cfg80211 cmp_bss() (CVE-2025-39864)Linux Kernel NBD ioctl Argument Validation Integer Overflow (CVE-2023-53513)Incomplete TCP Fast Open state cleanup in Linux kernel tcp_disconnect() (CVE-2025-39955)Use-after-free in Linux kernel qla2xxx remote-port termination (CVE-2023-53322)

Affected products

3 linked

Linux KernelRed Hat Enterprise LinuxLinux Kernel

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

27 references tracked. Mallory keeps watching after this page renders.

Redhat AccessNews · Jan 1, 2026

RHSA-2025:10830 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2025:23424 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2025:23426 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2023:7077 - Security Advisory - Red Hat Customer PortalOpen source ↗

19 additional sources from 09-11-2023 to 01-01-2026

Bugzilla RedhatNews · Nov 9, 2023

2173430 - (CVE-2023-1074) CVE-2023-1074 kernel: sctp: fail if no bound addresses can be used for a given scopeOpen source ↗

Bugzilla RedhatNews · Jun 21, 2023

2188396 - (CVE-2023-2194) CVE-2023-2194 kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()Open source ↗

Bugzilla RedhatNews · May 16, 2023

2168297 - (CVE-2023-23454) CVE-2023-23454 kernel: slab-out-of-bounds read vulnerabilities in cbq_classifyOpen source ↗

Bugzilla RedhatNews · Nov 15, 2022

2084125 - (CVE-2022-1679) CVE-2022-1679 kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privilegesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryendpoint-software-vulnerability

Red Hat RHEL 9 Kernel Updates Fix TCP Fast Open and qla2xxx Use-After-Free Flaws

Patch & Detection Intelligence · 27 sources · Updated 2mo ago · First seen Dec 22, 2025

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

27 events · Apr 7, 2022 – Dec 22, 2025

Reported Dec 22, 202511mo ago
Red Hat releases RHEL 8.2 kernel fix
Red Hat issued RHSA-2026:0643 to remediate CVE-2023-53322 for RHEL 8.2 Advanced Update Support.
CVE-2023-53322 - Red Hat Customer Portal
Reported Dec 22, 202511mo ago
Red Hat releases RHEL 8.6 kernel fix
Red Hat issued RHSA-2026:0536 to remediate CVE-2023-53322 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
CVE-2023-53322 - Red Hat Customer Portal
Dec 22, 202511mo ago
Red Hat fixes qla2xxx flaw in RHEL 7 extended support
Red Hat issued RHSA-2025:23947 and RHSA-2025:23960 to fix CVE-2023-53322 in the kernel and kernel-rt packages for RHEL 7 Extended Lifecycle Support.
CVE-2023-53322 - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat releases RHEL 9.4 extended-support kernel update
Red Hat issued Important-rated RHSA-2025:23450 for RHEL 9.4 Extended Update Support and associated channels. Kernel version 5.14.0-427.103.1.el9_4 fixes CVE-2025-39864, CVE-2025-39955, and CVE-2025-40186; affected systems require a reboot.
RHSA-2025:23450 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat issues RHEL 9.0 kernel security update
Red Hat issued Important-rated RHSA-2025:23426 for RHEL 9.0 Update Services for SAP Solutions. The update provides kernel 5.14.0-70.158.1.el9_0 packages that remediate CVE-2023-53322 and CVE-2025-40186 and requires a reboot.
RHSA-2025:23426 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat issues RHEL 9.0 real-time kernel security update
Red Hat issued Important-rated RHSA-2025:23424 for RHEL 9.0 Update Services for SAP Solutions. The kernel-rt update fixes CVE-2023-53322 and CVE-2025-40186, among other kernel vulnerabilities, and requires a reboot.
RHSA-2025:23424 - Security Advisory - Red Hat Customer Portal
Dec 17, 202511mo ago
Red Hat releases RHEL 8.4 extended-support kernel fix
Red Hat issued RHSA-2025:23463 to remediate CVE-2023-53322 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
CVE-2023-53322 - Red Hat Customer Portal
Nov 25, 20251y ago
Red Hat releases RHEL 8.8 telecommunications kernel fix
Red Hat issued RHSA-2025:22072 to fix CVE-2023-53322 in the RHEL 8.8 Telecommunications Update Service kernel.
CVE-2023-53322 - Red Hat Customer Portal
Sep 16, 20251y ago
Red Hat publishes CVE-2023-53322 record
Red Hat published its CVE record for CVE-2023-53322, documenting the qla2xxx terminate_rport_io() use-after-free vulnerability.
CVE-2023-53322 - Red Hat Customer Portal
Reported Aug 25, 20251y ago
Red Hat documents and fixes UDP memory-accounting flaw
Red Hat documented CVE-2025-22058, an integer-overflow flaw in the Linux kernel's UDP receive-memory accounting that can cause inflated accounting, packet drops, and denial of service. Red Hat issued fixes for affected RHEL 8, RHEL 9, and RHEL 10 product streams.
2360276 - (CVE-2025-22058) CVE-2025-22058 kernel: udp: Fix memory accounting leak.
Jul 14, 20251y ago
Red Hat issues RHEL 9.0 kernel update fixing ten CVEs
Red Hat issued Important-rated RHSA-2025:10830 for RHEL 9.0 Update Services for SAP Solutions, providing kernel version 5.14.0-70.138.1.el9_0. The update fixes ten kernel vulnerabilities, including flaws in UML, device mapper, IPv6 multicast, Squashfs, ATM LEC, ext4, UDF, and the Atlantic driver; systems must be rebooted after installation.
RHSA-2025:10830 - Security Advisory - Red Hat Customer Portal
May 22, 20242y ago
Red Hat fixes qla2xxx flaw in RHEL 8
Red Hat issued RHSA-2024:3138, updating the RHEL 8 kernel to remediate CVE-2023-53322, a use-after-free issue in the qla2xxx SCSI driver.
CVE-2023-53322 - Red Hat Customer Portal
Jan 24, 20243y ago
Red Hat releases RHEL 8.6 kernel security update
Red Hat issued Important-rated RHSA-2024:0412 for RHEL 8.6 Extended Update Support and associated channels, providing kernel version 4.18.0-372.87.1.el8_6. The update remediates numerous kernel flaws, including CVE-2023-2513 and CVE-2023-3772, and requires a reboot after installation.
RHSA-2024:0412 - Security Advisory - Red Hat Customer Portal
Reported Nov 15, 20233y ago
Red Hat documents and fixes ext4 use-after-free flaw
Red Hat documented CVE-2023-2513, a use-after-free vulnerability in Linux ext4 extended-attribute handling caused by integer underflow or overflow in extra inode-size offset calculations. The upstream fix was included in Linux 6.0-rc1, and Red Hat distributed fixes through kernel and kernel-rt errata for affected RHEL 8 and RHEL 9 streams.
2193097 - (CVE-2023-2513) CVE-2023-2513 kernel: ext4: use-after-free in ext4_xattr_set_entry()
Nov 14, 20233y ago
Red Hat releases RHEL 8 kernel update fixing ext4 flaw
Red Hat issued Important-rated RHSA-2023:7077 for RHEL 8, providing kernel 4.18.0-513.5.1.el8_9. The update remediated CVE-2023-2513 in ext4 extended-attribute handling along with numerous other kernel vulnerabilities; systems require a reboot after installation.
RHSA-2023:7077 - Security Advisory - Red Hat Customer Portal
Reported Nov 9, 20233y ago
Red Hat documents and fixes exFAT stack-overflow flaw
Red Hat documented CVE-2023-4273, a stack overflow in the Linux exFAT driver's filename reconstruction logic that malformed directory entries can trigger. The issue was fixed upstream in commit d42334578eba1390859012ebb91e1e556d51db49 and addressed for RHEL 9 through RHSA-2023:6583.
2221609 - (CVE-2023-4273) CVE-2023-4273 kernel: exFAT: stack overflow in exfat_get_uniname_from_ext_entry
Jun 30, 20233y ago
Researcher reports XFRM NULL-pointer denial-of-service flaw
Guilherme de Almeida Suckevicz reported CVE-2023-3772, in which a local user with CAP_NET_ADMIN can trigger a NULL-pointer dereference in xfrm_update_ae_params() and panic the Linux kernel. The flaw stems from use of unallocated XFRM replay-state pointers.
2218943 - (CVE-2023-3772) CVE-2023-3772 kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()
Jun 16, 20233y ago
Rohit Keshri reports relayfs out-of-bounds flaw
Rohit Keshri reported CVE-2023-3268, a medium-severity out-of-bounds memory-access vulnerability in the Linux kernel relayfs function relay_file_read_start_pos. A local attacker could crash an affected system or disclose internal kernel information; the issue was fixed upstream in Linux 6.4-rc1.
2215502 - (CVE-2023-3268) CVE-2023-3268 kernel: out-of-bounds access in relay_file_read
Jun 8, 20233y ago
Mauro Cascella reports fbcon shift-out-of-bounds flaw
Mauro Matteo Cascella reported CVE-2023-3161, a medium-severity shift-out-of-bounds flaw in the Linux Framebuffer Console's fbcon_set_font() function. Supplying font width or height values greater than 32 bypassed missing bounds checks, causing undefined behavior that could lead to denial of service.
2213485 - (CVE-2023-3161) CVE-2023-3161 kernel: fbcon: shift-out-of-bounds in fbcon_set_font()
Reported May 16, 20233y ago
Red Hat documents and fixes CBQ classifier out-of-bounds flaw
Red Hat documented CVE-2023-23454, an out-of-bounds read in the Linux CBQ traffic-control classifier's cbq_classify function caused by type confusion in classification-result handling. The flaw can allow a local attacker to cause denial of service; Red Hat addressed it in RHEL 8 advisories RHSA-2023:2736 and RHSA-2023:2951 and in RHEL 8.6 EUS through RHSA-2024:0412.
2168297 - (CVE-2023-23454) CVE-2023-23454 kernel: slab-out-of-bounds read vulnerabilities in cbq_classify
May 9, 20234y ago
Red Hat releases RHEL 9 fixes for ext4 use-after-free flaw
Red Hat released RHSA-2023:2458 for the RHEL 9 kernel and RHSA-2023:2148 for the RHEL 9 kernel-rt package, remediating CVE-2023-2513, an ext4 extended-attribute use-after-free vulnerability.
CVE-2023-2513 - Red Hat Customer Portal
Apr 20, 20234y ago
Mauro Cascella reports SLIMpro I2C out-of-bounds write flaw
Mauro Matteo Cascella reported CVE-2023-2194, a medium-severity out-of-bounds write in the Linux SLIMpro I2C driver's xgene_slimpro_i2c_xfer() path. An insufficiently validated user-controlled data->block[0] value can cause an out-of-bounds memcpy operation in slimpro_i2c_blkwr.
2188396 - (CVE-2023-2194) CVE-2023-2194 kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
Feb 26, 20234y ago
CVE-2023-1074 SCTP type-confusion flaw reported
CVE-2023-1074 was reported in the Linux kernel SCTP diagnostic code. An empty SCTP association bound-address list can cause inet_diag_msg_sctpasoc_fill() to invoke list_entry() on an invalid list element, creating a type-confused pointer that may return information to userspace.
2173430 - (CVE-2023-1074) CVE-2023-1074 kernel: sctp: fail if no bound addresses can be used for a given scope
Feb 26, 20234y ago
CVE-2023-1079 reported in Linux HID Asus driver
CVE-2023-1079, a medium-severity use-after-free flaw in the Linux HID Asus keyboard-backlight handling path, was reported. A malicious USB device impersonating an Asus device could trigger scheduled LED-controller work to access freed memory during connection or disconnection.
2173444 - (CVE-2023-1079) CVE-2023-1079 kernel: hid: Use After Free in asus_remove()
Reported Nov 15, 20224y ago
Red Hat closes tracking bug for ath9k HTC use-after-free flaw
Red Hat closed its tracking bug for CVE-2022-1679, a use-after-free in the Linux ath9k HTC wireless driver's ath9k_htc_probe_device() failure path. A stale driver-private pointer can be dereferenced during USB receive-stream processing, potentially allowing local kernel-memory access, crashes, or information disclosure.
2084125 - (CVE-2022-1679) CVE-2022-1679 kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges
Oct 18, 20224y ago
Linux kernel qdisc_graft use-after-free flaw reported
A Linux kernel mailing-list reference documented CVE-2023-0590, a use-after-free vulnerability caused by a race condition in qdisc_graft() in net/sched/sch_api.c. The flaw can cause denial of service; a syzkaller-triggered KASAN report showed a use-after-free read in __tcf_qdisc_find during traffic-control filter handling.
2165741 - (CVE-2023-0590) CVE-2023-0590 kernel: use-after-free due to race condition in qdisc_graft()
Apr 7, 20225y ago
Marian Rehak reports CAN-over-USB double-free flaw
Marian Rehak reported CVE-2022-28388, a double-free vulnerability in the Linux kernel's CAN-over-USB usb_8dev_start_xmit function. The issue affected kernel versions through 5.17.1 and was later fixed upstream in commit 3d3925ff6433f98992685a9679613a2cc97f3ce2.
2073091 - (CVE-2022-28388) CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

5 linked

Affected products

3 linked

Linux KernelRed Hat Enterprise LinuxLinux Kernel

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

27 references tracked. Mallory keeps watching after this page renders.

Redhat AccessNews · Jan 1, 2026

RHSA-2025:10830 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2025:23424 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2025:23426 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2023:7077 - Security Advisory - Red Hat Customer PortalOpen source ↗

19 additional sources from 09-11-2023 to 01-01-2026

Bugzilla RedhatNews · Nov 9, 2023

2173430 - (CVE-2023-1074) CVE-2023-1074 kernel: sctp: fail if no bound addresses can be used for a given scopeOpen source ↗

Bugzilla RedhatNews · Jun 21, 2023

2188396 - (CVE-2023-2194) CVE-2023-2194 kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()Open source ↗

Bugzilla RedhatNews · May 16, 2023

2168297 - (CVE-2023-23454) CVE-2023-23454 kernel: slab-out-of-bounds read vulnerabilities in cbq_classifyOpen source ↗

Bugzilla RedhatNews · Nov 15, 2022

2084125 - (CVE-2022-1679) CVE-2022-1679 kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privilegesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Red Hat RHEL 9 Kernel Updates Fix TCP Fast Open and qla2xxx Use-After-Free Flaws

How this story unfolded

Red Hat releases RHEL 8.2 kernel fix

Red Hat releases RHEL 8.6 kernel fix

Red Hat fixes qla2xxx flaw in RHEL 7 extended support

Red Hat releases RHEL 9.4 extended-support kernel update

Red Hat issues RHEL 9.0 kernel security update

Red Hat issues RHEL 9.0 real-time kernel security update

Red Hat releases RHEL 8.4 extended-support kernel fix

Red Hat releases RHEL 8.8 telecommunications kernel fix

Red Hat publishes CVE-2023-53322 record

Red Hat documents and fixes UDP memory-accounting flaw

Red Hat issues RHEL 9.0 kernel update fixing ten CVEs

Red Hat fixes qla2xxx flaw in RHEL 8

Red Hat releases RHEL 8.6 kernel security update

Red Hat documents and fixes ext4 use-after-free flaw

Red Hat releases RHEL 8 kernel update fixing ext4 flaw

Red Hat documents and fixes exFAT stack-overflow flaw

Researcher reports XFRM NULL-pointer denial-of-service flaw

Rohit Keshri reports relayfs out-of-bounds flaw

Mauro Cascella reports fbcon shift-out-of-bounds flaw

Red Hat documents and fixes CBQ classifier out-of-bounds flaw

Red Hat releases RHEL 9 fixes for ext4 use-after-free flaw

Mauro Cascella reports SLIMpro I2C out-of-bounds write flaw

CVE-2023-1074 SCTP type-confusion flaw reported

CVE-2023-1079 reported in Linux HID Asus driver

Red Hat closes tracking bug for ath9k HTC use-after-free flaw

Linux kernel qdisc_graft use-after-free flaw reported

Marian Rehak reports CAN-over-USB double-free flaw

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat Kernel Updates Fix TCP Fast Open Use-After-Free in RHEL 8 and 9

Red Hat RHEL 9 SAP Kernel Updates Fix Local Privilege Escalation Flaw

Red Hat Kernel Updates Fix Memory-Safety and DoS Flaws Across RHEL Releases

Red Hat RHEL 9 Kernel Updates Fix TCP Fast Open and qla2xxx Use-After-Free Flaws

How this story unfolded

Red Hat releases RHEL 8.2 kernel fix

Red Hat releases RHEL 8.6 kernel fix

Red Hat fixes qla2xxx flaw in RHEL 7 extended support

Red Hat releases RHEL 9.4 extended-support kernel update

Red Hat issues RHEL 9.0 kernel security update

Red Hat issues RHEL 9.0 real-time kernel security update

Red Hat releases RHEL 8.4 extended-support kernel fix

Red Hat releases RHEL 8.8 telecommunications kernel fix

Red Hat publishes CVE-2023-53322 record

Red Hat documents and fixes UDP memory-accounting flaw

Red Hat issues RHEL 9.0 kernel update fixing ten CVEs

Red Hat fixes qla2xxx flaw in RHEL 8

Red Hat releases RHEL 8.6 kernel security update

Red Hat documents and fixes ext4 use-after-free flaw

Red Hat releases RHEL 8 kernel update fixing ext4 flaw

Red Hat documents and fixes exFAT stack-overflow flaw

Researcher reports XFRM NULL-pointer denial-of-service flaw

Rohit Keshri reports relayfs out-of-bounds flaw

Mauro Cascella reports fbcon shift-out-of-bounds flaw

Red Hat documents and fixes CBQ classifier out-of-bounds flaw

Red Hat releases RHEL 9 fixes for ext4 use-after-free flaw

Mauro Cascella reports SLIMpro I2C out-of-bounds write flaw

CVE-2023-1074 SCTP type-confusion flaw reported

CVE-2023-1079 reported in Linux HID Asus driver

Red Hat closes tracking bug for ath9k HTC use-after-free flaw

Linux kernel qdisc_graft use-after-free flaw reported

Marian Rehak reports CAN-over-USB double-free flaw

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Red Hat Kernel Updates Fix TCP Fast Open Use-After-Free in RHEL 8 and 9

Red Hat RHEL 9 SAP Kernel Updates Fix Local Privilege Escalation Flaw

Red Hat Kernel Updates Fix Memory-Safety and DoS Flaws Across RHEL Releases