Loading story…
Red Hat addressed CVE-2022-36879, a moderate-severity Linux kernel flaw in the XFRM packet-transformation framework. Faulty policy resolution in xfrm_bundle_lookup/xfrm_expand_policies can decrement a reference count twice, creating a memory-lifecycle error that a local, low-privileged attacker could use to crash the kernel and cause denial of service. Red Hat rates the issue CVSS 5.5, with high availability impact and no confidentiality or integrity impact.
The defect affects upstream kernels through version 5.18.14; Fedora incorporated the correction in kernel 5.18.15, while upstream Linux includes it in version 5.19. Red Hat shipped fixes for supported RHEL 8 and RHEL 9 releases, including specified kernel-rt and Extended Update Support variants, as well as Red Hat Virtualization 4 for RHEL 8. Organizations should install the applicable supported kernel update and reboot where required; RHEL 6 and RHEL 7 are outside Red Hat's supported scope for this issue.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2024:0432, an Important RHEL 9.0 Extended Update Support kernel update to version 5.14.0-70.85.1.el9_0 that fixes CVE-2022-36879 and other vulnerabilities. Systems require a reboot after installation for the updated kernel to take effect.
Red Hat released fixes for RHEL 8 kernel packages in RHSA-2023:2951 and RHEL 8 kernel-rt packages in RHSA-2023:2736.
Red Hat shipped fixes for RHEL 9 kernel packages through RHSA-2023:2458 and for kernel-rt packages through RHSA-2023:2148.
Guilherme de Almeida Suckevicz reported the xfrm_expand_policies() reference-count issue, affecting Linux kernels through version 5.18.14.
CVE-2022-36879 was publicly listed for a Linux kernel XFRM policy-handling flaw that could drop a reference count twice and cause a kernel denial of service.
Red Hat addressed CVE-2022-36879 in RHEL 9.0 Extended Update Support kernel-rt packages through RHSA-2024:0431.
RHSA-2023:5627 delivered the CVE-2022-36879 fix for RHEL 8.6 Extended Update Support kernel packages and Red Hat Virtualization 4 for RHEL 8 kernel packages.
Fedora fixed the issue in its 5.18.15 stable kernel updates, while the upstream Linux kernel fix was included in version 5.19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-38500** is a use-after-free and double-free flaw in the Linux kernel's XFRM interface implementation. A logic error in `xfrmi_changelink()` allowed modification of a `collect_md` XFRM interface despite that setting being creation-time-only, placing the same interface in both the normal XFRM hash and the `collect_md_xfrmi` pointer. Destroying the affected network namespace can then free the interface twice, causing a kernel BUG in `unregister_netdevice_many_notify()`, a kernel oops, or denial of service. The issue affects code introduced in Linux 6.1 and requires local low-privileged access with `CAP_NET_ADMIN` to alter XFRM interfaces. Upstream fixes are available in Linux 6.6.101, 6.12.41, 6.15.9, and 6.16. Red Hat rated the vulnerability CVSS 7.8 and released fixes for RHEL 9, RHEL 10, and RHEL 9.4 EUS; its RHEL 9 `kernel-rt` package remained affected at the time of the advisory.
Aug 26, 2026
Red Hat remediated **CVE-2022-42703**, a moderate-severity Linux kernel memory-management flaw in `mm/rmap.c` involving incorrect double reuse of a leaf `anon_vma` in `is_mergeable_anon_vma()`. An unprivileged local attacker could repeatedly invoke fork and memory operations to trigger a use-after-free and memory leak, causing a system crash. The issue affects kernels before version 5.19.7; upstream fixed it in commit `2555283eb40df89945557273121e9393ef9b542b`. Red Hat rated the flaw CVSS 3.1 **5.5**, with high availability impact and no assessed confidentiality or integrity impact. Fixes were issued for RHEL 7, 8, 8.6 Extended Update Support, 9, 9.0 Extended Update Support, and Red Hat Virtualization 4 on RHEL 8; Fedora incorporated the stable 5.19.7 kernel fix. RHSA-2023:3388 delivered the fix for RHEL 8.6 EUS alongside patches for three other kernel vulnerabilities. Organizations should install the applicable updated kernel packages and reboot affected systems; Red Hat identified no separate supported mitigation.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026