Loading story…
Red Hat released Important-rated RHEL 9 kernel and real-time kernel updates that remediate a broad set of Linux kernel vulnerabilities across networking, traffic control, XFRM, IPv6, USB, Wi-Fi, memory management, and virtualization components. The updates include kernel-rt-5.14.0-284.11.1.rt14.296.el9_2 for x86_64 and corresponding standard kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 9 deployments, including EUS, ELS, SAP, AUS, and CodeReady variants.
Notable fixes include races and memory-safety flaws tracked as CVE-2022-3028, CVE-2022-3567, CVE-2022-3522, CVE-2022-4129, CVE-2022-43750, CVE-2022-47929, CVE-2023-0394, and CVE-2023-0590. Impacts range from local denial of service and kernel-information disclosure to potential privilege escalation; CVE-2022-3628 can be triggered through a malicious USB device against the brcmfmac Wi-Fi driver. Organizations should apply the applicable supported RHEL kernel errata, reboot systems to activate the new kernel, and, where patching CVE-2022-3628 is not immediately possible, prevent loading the brcmfmac module.
See real exploitation activity before you spend the cycle.
17 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:6901 for the RHEL 8 kernel-rt and RHSA-2023:7077 for the standard RHEL 8 kernel to remediate CVE-2023-0590.
Red Hat issued RHSA-2023:5627 to fix the qdisc_graft use-after-free vulnerability in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat issued RHSA-2023:2736 for RHEL 8 kernel-rt and RHSA-2023:2951 for the RHEL 8 kernel, addressing vulnerabilities including CVE-2022-3028, CVE-2022-3567, CVE-2022-3628, and CVE-2022-43750.
Red Hat issued Important advisories RHSA-2023:2148 and RHSA-2023:2458 for RHEL 9 kernel-rt and kernel packages. The updates remediated numerous kernel flaws across networking, Bluetooth, wireless, USB, KVM, memory management, and other subsystems; systems using the standard kernel update require a reboot.
Red Hat issued RHSA-2023:1987 for the RHEL 7 kernel and RHSA-2023:1988 for kernel-rt, remediating the usbmon out-of-bounds write and memory-corruption vulnerability.
Red Hat's tracking record was opened for a traffic-control qdisc_graft NULL-pointer dereference caused by failure handling that does not validate alloc_workqueue().
Guilherme de Almeida Suckevicz reported the usbmon memory-corruption flaw, which allows a user-space client to corrupt the driver's internal monitor memory.
Red Hat received a tracking report for a USB-accessible buffer overflow in the Broadcom brcmfmac Wi-Fi driver, where a malicious device can supply an oversized array index.
Rohit Keshri reported a Linux IPv6 networking data race around the sk->sk_prot socket protocol pointer, caused by access without the required synchronization.
A version 4 upstream patch for the Linux L2TP locking issue was published. A follow-up patch series later that month said an earlier patch had not fully resolved the flaw.
Rohit Keshri reported the VM_PFNMAP race between unmap_mapping_range() and munmap(), which can leave stale TLB entries after a device driver frees a page.
Mauro Matteo Cascella reported Red Hat's tracking issue for a race in xfrm_probe_algs that could enable out-of-bounds reads or writes in the Linux kernel XFRM subsystem.
Jakub Sitnicki published multiple upstream patch revisions for the Linux L2TP locking flaw in August 2022. The race could produce a NULL-pointer dereference and denial of service.
Red Hat addressed CVE-2023-0461, a net/ulp use-after-free involving stale TLS or XFRM ESP-in-TCP ULP contexts that can permit unprivileged local privilege escalation. Fixes were issued for multiple RHEL 8 and 9 streams, including EUS, SAP, telecommunications, and Red Hat Virtualization packages; Fedora also fixed the issue in stable kernel 6.1.5 updates.
Red Hat issued RHSA-2024:0412 for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 on RHEL 8, addressing several of the tracked kernel vulnerabilities, including CVE-2022-3028, CVE-2022-3567, CVE-2022-3628, and CVE-2022-43750.
Red Hat issued RHSA-2023:7382 and RHSA-2023:7389 to fix CVE-2023-0590 in the RHEL 9.0 Extended Update Support kernel and kernel-rt packages.
Red Hat closed tracking bugs for CVE-2022-3567, CVE-2022-3028, CVE-2022-3628, CVE-2022-43750, CVE-2022-47929, and CVE-2023-0394 after issuing product advisories.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-severity kernel updates for **RHEL 9.2** support channels, including Extended Update Support, Extended Life Cycle, AUS, SAP, and Real Time Linux offerings. The fixes address ten Linux-kernel vulnerabilities spanning memory corruption, out-of-bounds access, use-after-free conditions, NULL-pointer dereferences, SCTP validation, conntrack, NVMe-over-TCP, kTLS, and USB-storage components. The updates include **CVE-2023-6610**, an out-of-bounds read in the SMB client debug path that can be triggered by an unknown SMB frame when `CONFIG_CIFS_DEBUG2` is enabled, potentially causing a crash or leaking kernel information. They also remediate **CVE-2023-45862**, an out-of-bounds memory condition in the ENE UB6250 USB card-reader driver. Organizations using affected RHEL 9.2 systems should install `kernel-5.14.0-284.52.1.el9_2` or `kernel-rt-5.14.0-284.52.1.rt14.337.el9_2`, as applicable, and reboot to activate the patches.
Aug 26, 2026