Loading story…
Red Hat released RHSA-2023:6901, an Important security update for the kernel-rt package in Red Hat Enterprise Linux 8. The update affects RHEL for Real Time 8, Real Time for NFV 8, and RHEL for x86_64 Extended Life Cycle 8.10, remediating a broad set of kernel memory-safety, race-condition, denial-of-service, information-disclosure, and speculative-execution weaknesses. Organizations should install the applicable updated kernel package and reboot affected hosts for the protections to take effect.
Notable issues addressed across the associated RHEL errata include CVE-2023-31436, an out-of-bounds access in traffic-control QFQ that can enable local privilege escalation; CVE-2023-1998, which can defeat Spectre v2 speculation protections between SMT sibling threads; and Bluetooth L2CAP flaws CVE-2022-3640 and CVE-2022-42895, involving use-after-free and kernel-pointer disclosure. Other fixes cover double-free, buffer-overflow, and device-driver vulnerabilities, including CVE-2023-1079 in the ASUS HID driver and CVE-2023-26545 in MPLS. Where patching cannot be immediate, Red Hat documents limited mitigations such as preventing the usb_8dev module or affected ASUS HID driver from loading; however, applying the relevant security errata remains the recommended remediation.
See real exploitation activity before you spend the cycle.
32 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:22910 for RHEL 7 Extended Lifecycle Support kernel packages and RHSA-2025:22914 for kernel-rt packages, fixing CVE-2022-3640.
Red Hat released RHSA-2024:2621 for RHEL 8.8 Extended Update Support kernel packages, addressing CVE-2022-3640 and CVE-2022-42895.
Red Hat released RHSA-2024:1877 for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 kernel packages, addressing CVE-2022-3640 and CVE-2022-42895.
Red Hat issued RHBA-2023:7328, updating OpenShift Dev Spaces 3 dashboard, plugin-registry, and UDI container images for x86_64, ppc64le, and s390x. The advisory incorporated RHSA-2023:7077 security fixes for numerous Linux kernel CVEs and instructed users to upgrade the images and rebuild dependent container images.
Red Hat released RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for RHEL 8 kernel packages, remediating CVE-2021-43975, an out-of-bounds write in the Aquantia AQtion Ethernet-card Atlantic driver. Exploitation requires high privileges and a malicious or emulated networking device, and could crash the system or corrupt memory.
Red Hat issued the Important RHSA-2023:6901 advisory, updating RHEL 8 kernel-rt to 4.18.0-513.5.1.rt7.307.el8_9. The update remediated a broad set of kernel flaws, including CVE-2022-28388, CVE-2022-3640, CVE-2022-42895, CVE-2023-1079, CVE-2023-26545, CVE-2023-28772, CVE-2023-31436, CVE-2023-35823, CVE-2023-35824, CVE-2023-4732, and Spectre-related CVE-2023-1998; affected systems require a reboot after installation.
Red Hat released RHSA-2023:6583 for RHEL 9, addressing CVE-2023-1079 in the ASUS HID driver.
CVE-2023-5178 was described in the Linux NVMe-over-Fabrics TCP subsystem's nvmet_tcp_free_crypto() function. The logical flaw can trigger use-after-free and double-free conditions, potentially enabling remote code execution or local privilege escalation; Red Hat later issued fixes across affected RHEL 8 and 9 channels.
Rohit Keshri reported CVE-2023-4732, a Linux memory-management race between page migration and exit_mmap that can trigger a BUG condition in pfn_swap_entry_to_page().
Mauro Matteo Cascella reported CVE-2023-4132, a use-after-free in the Linux smsusb driver. During failed Siano USB device initialization, worker threads can continue after smsusb_term_device() frees the smsusb_device_t object; upstream fixes were committed and Fedora fixed the issue in stable kernel 6.4.4.
Mauro Matteo Cascella reported CVE-2023-39198 (ZDI-CAN-20940), a race in the Linux QXL graphics driver's qxl_mode_dumb_create() path that can cause a use-after-free. Upstream fixed the issue in commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 and Linux 6.5-rc7; Fedora and Red Hat later issued affected-release fixes.
Tej Rathi reported CVE-2023-35825, a race condition in the Linux R592 MemoryStick host driver's r592_remove() path that can cause a use-after-free. The flaw affects kernels before 6.3.4 and was fixed upstream in Linux 6.3.4 by commit 63264422785021704c39b38f65a78ab9e4a186d7.
Tej Rathi reported CVE-2023-35823 and CVE-2023-35824, race conditions in the saa7134 media-driver core and dm1105 driver, respectively, that can result in use-after-free conditions.
CVE-2023-3212 was reported in the Linux GFS2 filesystem's gfs2_evict_inode() path. On a corrupted GFS2 filesystem, a freed and NULL journal descriptor can be referenced during gfs2_trans_begin(), causing a NULL-pointer dereference; it was fixed upstream in commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636.
Rohit Keshri reported CVE-2023-3141, a low-severity use-after-free in the Linux R592 MemoryStick driver's r592_remove() function. A local attacker could trigger a crash during device disconnection and potentially disclose kernel information; the flaw was fixed upstream in Linux 6.4-rc1.
Red Hat released RHSA-2023:2458 for RHEL 9 kernel packages and RHSA-2023:2148 for RHEL 9 kernel-rt packages, remediating the USB2CAN double-free flaw CVE-2022-28388 and Bluetooth L2CAP use-after-free CVE-2022-3640.
Mauro Matteo Cascella reported CVE-2023-33203, a race condition in the Qualcomm EMAC network driver where unfinished work can continue during emac_remove() cleanup and cause a use-after-free. The upstream fix is commit 6b6bc5b8bd2d.
Pedro Sampaio reported CVE-2023-26545, a double-free in the Linux MPLS subsystem that could occur when sysctl-table allocation fails during device renaming.
Pedro Sampaio reported CVE-2023-28772, a buffer-overflow vulnerability in the Linux kernel's seq_buf_putmem_hex function.
Rohit Keshri reported CVE-2023-28328 in the az6027 USB media driver. Insufficient validation of a userspace-supplied message could cause a null-pointer dereference and local denial of service.
CVE-2023-1079, a use-after-free in the Linux ASUS HID keyboard-backlight handling path, was reported. A malicious USB device impersonating an ASUS device could trigger access to freed memory during connection or disconnection.
Guilherme de Almeida Suckevicz reported CVE-2022-45869, a race condition in the Linux x86 KVM MMU direct_page_fault() path. With nested virtualization and the TDP MMU enabled, a guest user could crash the host or cause host-memory corruption; the flaw was fixed upstream in Linux 6.1-rc7.
Pedro Sampaio reported CVE-2022-42895, a remotely exploitable information-disclosure flaw in the Linux Bluetooth L2CAP configuration-request parser that can leak kernel pointers.
CVE-2023-4622 affects the Linux kernel af_unix component, where unix_stream_sendpage() can access a peer receive-queue socket buffer without locking while garbage collection releases it, causing a use-after-free that may permit local privilege escalation. Upstream fixed the issue in commit 790c2f9d15b594350ae9bca7b236f2b1859de02c; Fedora and Red Hat issued fixes for affected releases.
CVE-2023-1118 was identified in the Linux ENE infrared receiver driver’s ene_remove() path, where races with device opens, IRQ activity, and an uncancelled timer can access freed resources or device memory. The issue can allow an unprivileged local attacker detaching an RC device to crash the kernel; it was fixed upstream by commit 29b0589a865b6f66d141d79b2dd1373e4e50fe17 and included in Fedora kernel 6.1.16 stable updates.
CVE-2023-33951 was identified in the Linux vmwgfx graphics driver's handling of GEM objects, where insufficient locking can allow a local attacker with existing high-privileged code execution to disclose sensitive kernel information. The issue is tracked as ZDI-CAN-20110 and was fixed upstream in commit 9ef8d83; Red Hat addressed it in affected RHEL 8, RHEL 9, and EUS releases.
CVE-2023-33952 was identified in the Linux kernel vmwgfx driver's handling of vmw_buffer_object objects, where freeing an object without verifying it still exists can cause a double free. A local attacker who already has high-privileged code execution could escalate privileges and execute code in kernel context; upstream commit 9ef8d83 remediated the issue.
Red Hat released RHSA-2024:1404 for RHEL 8.8 Extended Update Support kernel packages, remediating CVE-2022-28388 and CVE-2023-28772.
Red Hat released RHSA-2024:0724, fixing CVE-2022-28388 for RHEL 8.6 Extended Update Support kernel packages and Red Hat Virtualization 4; the advisory also addressed CVE-2023-28772 in the RHEL 8.6 EUS stream.
Red Hat released RHSA-2024:0575 for RHEL 8.8 Extended Update Support, including a fix for CVE-2023-1079 and other affected kernel vulnerabilities.
Red Hat released RHSA-2024:0412 for RHEL 8.6 Extended Update Support, remediating several flaws covered by RHSA-2023:6901, including CVE-2023-1079, CVE-2023-26545, CVE-2023-35823, CVE-2023-35824, and CVE-2023-4732.
Red Hat addressed CVE-2021-43975, an out-of-bounds write in the Aquantia Atlantic Ethernet driver, for Red Hat Enterprise Linux 8.6 Extended Update Support through RHSA-2024:1188.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
34 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released RHEL 8 kernel security updates through **RHSA-2022:1975** for Real Time Linux and **RHSA-2022:1988** for related RHEL 8 packages, remediating numerous kernel vulnerabilities affecting memory safety, privilege boundaries, networking, USB, eBPF, denial of service, information disclosure, and speculative execution. Notable fixes include `CVE-2021-3612`, an out-of-bounds write in joystick ioctl handling; `CVE-2021-3759`, which could bypass memory-cgroup accounting and crash a host; `CVE-2021-3743`, an out-of-bounds read in the QRTR protocol handler; and `CVE-2021-3773`, involving Netfilter behavior that could affect certain OpenVPN NAT deployments. Affected Real Time, NFV, Telecommunications Update Service, and Extended Life Cycle RHEL 8 x86_64 systems should update to `kernel-rt-4.18.0-372.9.1.rt7.166.el8` or a later applicable package and reboot. Red Hat also refreshed Quarkus 2.7, CodeReady Workspaces 2.0, and `rhpam-kogito-builder-rhel8` container images that incorporate the kernel fixes; organizations using those images should pull the updated versions, update Dockerfile or build-script references, and rebuild dependent images.
Aug 26, 2026