Loading story…
Red Hat released RHSA-2023:7423 for Red Hat Enterprise Linux 7, updating the kernel to 3.10.0-1160.105.1.el7 across x86_64, s390x, ppc64, and ppc64le systems. The advisory remediates multiple use-after-free vulnerabilities in Linux traffic-control classifiers—including cls_fw, cls_u32, and cls_route—that could allow a local attacker to escalate privileges, as well as flaws in the sch_qfq scheduler component.
The update also mitigates CVE-2022-40982 (Downfall/Gather Data Sampling), a moderate-severity Intel transient-execution side channel through which a low-privileged local attacker could infer stale data from vector registers on the same physical CPU core. Red Hat recommends installing the updated kernel and applicable microcode updates, including microcode_ctl-20230808; affected RHEL 7 systems must be rebooted for the kernel fixes to take effect.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2024:1831 for RHEL 6 Extended Lifecycle Support, providing kernel 2.6.32-754.53.1.el6. The update remediates CVE-2023-31436, CVE-2023-3611, CVE-2023-3776, and CVE-2023-4921 in Linux traffic-control and network-scheduling components; affected systems require a reboot.
Red Hat issued Important advisory RHSA-2023:7423 and RHSA-2023:7424 for RHEL 7, updating the kernel and kernel-rt packages. RHSA-2023:7423 supplied kernel version 3.10.0-1160.105.1.el7 and remediated CVE-2022-40982 plus net/sched flaws including CVE-2023-4128 and CVE-2023-4206 through CVE-2023-4208; systems require a reboot after installation.
Red Hat issued RHSA-2023:6901 and RHSA-2023:7077 for RHEL 8, providing kernel-rt and kernel fixes for CVE-2022-40982, respectively. These advisories are also listed as addressing the overlapping net/sched use-after-free vulnerabilities.
Red Hat issued RHSA-2023:5221, RHSA-2023:5244, and RHSA-2023:5255 for RHEL 8 kernel-rt, kpatch-patch, and kernel packages to remediate the CVE-2023-3776 cls_fw use-after-free vulnerability.
Red Hat released RHSA-2022:7444 for the RHEL 8 kernel-rt package and RHSA-2022:7683 for the RHEL 8 kernel package to remediate CVE-2022-29581, a use-after-free flaw in the cls_u32 network classifier's u32_change function.
Guilherme de Almeida Suckevicz reported CVE-2022-29581, a use-after-free in the Linux net/sched cls_u32 u32_change function caused by incorrect reference-count updates. The flaw could allow a local attacker to crash a system and potentially escalate privileges or leak kernel information.
Red Hat documents CVE-2023-4128 as rejected as a duplicate of the related Linux kernel classifier vulnerability. It also advises blacklisting the cls_u32 module to prevent automatic module loading as a mitigation for the related use-after-free flaws.
A use-after-free vulnerability in the Linux net/sched sch_qfq traffic-control scheduler can allow local privilege escalation when an attacker configures sch_plug as a QFQ class and sends network packets. Red Hat remediated CVE-2023-4921 through advisories covering RHEL 6, 7, and 8 support streams, while Fedora fixed it in Linux 6.5.4 stable-kernel updates.
Red Hat issued errata for the net/sched classifier use-after-free flaws across RHEL 7, 8, and 9 and specialized EUS, SAP, telecommunications, and advanced-support streams. Listed advisories include RHSA-2023:5235, RHSA-2023:5238, RHSA-2023:5548, RHSA-2023:5575, RHSA-2023:5580, RHSA-2023:5588, RHSA-2023:5589, RHSA-2023:5603, RHSA-2023:5604, RHSA-2023:5627, RHSA-2023:5628, RHSA-2023:5775, RHSA-2023:5794, RHSA-2023:7418, RHSA-2023:7419, RHSA-2023:7539, RHSA-2023:7558, RHSA-2024:0261, and RHSA-2024:0262.
Red Hat issued additional microcode- and kernel-related advisories for CVE-2022-40982 across RHEL 7, 8, and 9, including Extended Update Support, Advanced Update Support, Telecommunications Update Service, and SAP Solutions offerings. The listed advisories include RHSA-2023:6583, RHSA-2023:7370, RHSA-2023:7379, RHSA-2023:7539, RHSA-2024:0412, RHSA-2024:0562, RHSA-2024:0563, RHSA-2024:1250, RHSA-2024:1268, RHSA-2024:1269, and RHSA-2024:1306.
Red Hat issued RHSA-2024:3319 to fix CVE-2022-40982 in the RHEL 7.7 Advanced Update Support kernel.
A use-after-free flaw in the Linux net/sched cls_fw component can permit local privilege escalation when tcf_change_indev() fails during fw_set_parms() processing after tcf_bind_filter() changes a reference count. An attacker able to control that counter can reduce it to zero and free an object that remains referenced; upstream fixed the issue in commit 0323bce598eea038714f941ce2b22541c46d488f.
CVE-2023-4128 was identified in the Linux net/sched cls_fw, cls_u32, and cls_route classifiers, where incorrect filter handling can cause a use-after-free condition and local privilege escalation. Red Hat's CVE overlaps with CVE-2023-4206, CVE-2023-4207, and CVE-2023-4208, which Google assigned concurrently for the same patch set.
CVE-2022-40982 (Gather Data Sampling) was identified as a transient-execution side-channel flaw in certain Intel processors. A local low-privileged attacker can use gather instructions to infer limited stale vector-register data from the same physical CPU core; Intel TDX-capable processors are not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
19 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcegit.kernel.org
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel updates for **RHEL 7** and **RHEL for Real Time 7**, delivering `3.10.0-1160.21.1.el7` and `3.10.0-1160.21.1.rt56.1158.el7` respectively. The advisories remediate 11 vulnerabilities, including arbitrary backing-store writes through the LIO SCSI target implementation (`CVE-2020-28374`), a Netfilter conntrack buffer overflow (`CVE-2020-25211`), virtual-terminal and pinctrl use-after-free information disclosures (`CVE-2020-25656`, `CVE-2020-0427`), and a local memory-exhaustion denial of service (`CVE-2021-20265`). The fixes also address an ICMP rate-limiting weakness that can enable off-path UDP-port inference and DNS cache poisoning (`CVE-2020-25705`), as well as flaws reachable through malicious USB devices, including HID-driver out-of-bounds writes (`CVE-2019-19532`). Organizations operating affected RHEL 7, extended-support, virtualization-host, and real-time deployments should install the applicable kernel packages and reboot systems; where patching is delayed, restricting exposure to untrusted USB hardware, LIO exports, and unnecessary Netfilter conntrack-netlink access can reduce risk.
Aug 28, 2026
Red Hat released updated Linux kernel and `kernel-rt` packages for affected RHEL 7, 8, and 9 streams to address Intel processor MMIO stale-data vulnerabilities: `CVE-2022-21123` (SBDR), `CVE-2022-21125` (SBDS), and `CVE-2022-21166` (DRPW). The flaws stem from incomplete cleanup of shared buffers, fill buffers, and special-register write resources, potentially exposing stale processor data. Updates cover standard RHEL releases as well as EUS, AUS, TUS, SAP, telecommunications, and mission-critical offerings across supported architectures. Several advisories also remediate `CVE-2022-2588`, a `cls_route` use-after-free that could enable local privilege escalation, alongside other kernel flaws; separate RHEL updates address `CVE-2022-1158` in KVM and `CVE-2022-2639`, an Open vSwitch out-of-bounds write. Organizations should install the applicable updated kernel packages, reboot systems to activate the fixes, and update or rebuild affected Red Hat OpenStack Platform 17.0 container images where applicable.
Aug 26, 2026
Red Hat released **RHSA-2024:2004** for standard Red Hat Enterprise Linux 7 kernels and **RHSA-2024:2003** for RHEL for Real Time 7, addressing five vulnerabilities: `CVE-2020-36558`, `CVE-2023-2002`, `CVE-2023-25775`, `CVE-2023-4622`, and `CVE-2023-4623`. The flaws include use-after-free conditions in `unix_stream_sendpage` and `sch_hfsc`, unauthorized Bluetooth management-command execution, improper access control in `irdma`, and a race in the `VT_RESIZEX` ioctl handler that can trigger a NULL-pointer dereference and crash a system. The standard RHEL 7 advisory provides kernel version `3.10.0-1160.118.1.el7`; the Real Time advisory affects RHEL for Real Time, Real Time for NFV, and eligible x86_64 Extended Life Cycle Support deployments. Red Hat previously tracked the VT console issue as `CVE-2020-36558`, affecting kernels before 5.5.7, and had also issued RHEL 8 fixes through earlier kernel updates. Administrators should apply applicable prerequisite errata and updated kernel packages, then reboot systems for the mitigations to take effect.
Aug 26, 2026