Loading story…
Red Hat issued Important updates for CVE-2022-4744, a CVSS 7.8 double-free vulnerability in the Linux kernel TUN/TAP driver. When network-device registration fails during NETDEV_REGISTER notifier handling, the tun_free_netdev cleanup path can free memory twice. A local low-privileged user can trigger the failure by attempting to create a TUN device named default or all, names reserved in /proc/sys/net/ipv4/conf/, potentially causing a denial of service or escalating privileges. The upstream fix is commit 158b515f703e.
The affected and reproducibly exploitable path was identified in RHEL 9; Red Hat released updated standard and real-time kernels through RHSA-2023:1470 and RHSA-2023:1469, plus the rebootless kpatch-patch live patch in RHSA-2023:1471. Updates cover RHEL 9 deployments across x86_64, ARM64, s390x, and ppc64le, including applicable EUS, AUS, SAP, and lifecycle channels. Organizations should install the relevant kernel update and reboot, or deploy the live patch where supported; preventing the tun module from loading is a possible interim mitigation when operationally feasible.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:1467 for the kernel-rt package on RHEL 9.0 Update Services for SAP Solutions, fixing CVE-2022-4744 in the Linux TUN driver's tun_free_netdev path. The update supplies kernel-rt version 5.14.0-70.50.2.rt21.122.el9_0 and requires a reboot to take effect.
Red Hat issued updates for RHEL 9 and RHEL 9.0 Extended Update Support that fixed CVE-2022-4744, including RHSA-2023:1469, RHSA-2023:1470, and RHSA-2023:1471 for kernel-rt, kernel, and kpatch-patch packages. The releases also included RHEL 9.0 EUS kernel, kernel-rt, and live-patch updates; conventional kernel updates required a reboot, while the kpatch module loads through its post-install script.
Red Hat issued RHSA-2024:1404, providing a CVE-2022-4744 fix for the RHEL 8.8 Extended Update Support kernel.
Red Hat issued RHSA-2023:6901 for the RHEL 8 kernel-rt package and RHSA-2023:7077 for the RHEL 8 kernel package, addressing CVE-2022-4744.
Fedora remediated CVE-2022-4744 through its 5.15.12 stable kernel updates and tracked the issue as bug 2180939.
Upstream Linux addressed CVE-2022-4744 with commit 158b515f703e, "tun: avoid double free in tun_free_netdev." The flaw could be triggered through a failed register_netdevice() path, including by using reserved device names such as "default" or "all."
Jann Horn of Google Project Zero reported CVE-2022-4744, a double-free vulnerability in the Linux kernel TUN/TAP device driver that can occur when device registration fails during NETDEV_REGISTER notifier handling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2023:7418**, an Important-security update for the RHEL 9.2 `kpatch-patch` live-patching module, remediating eight Linux kernel vulnerabilities across supported x86_64 and ppc64le subscription streams. The RPM automatically loads the live patch after installation, updating vulnerable running kernel code without requiring a conventional reboot-based kernel replacement. The fixes include **CVE-2023-3812** (CVSS 7.8), an out-of-bounds write in the TUN/TAP driver that a low-privileged local user can trigger with an oversized IPv6 packet when NAPI fragments are enabled, potentially causing a crash or privilege escalation. They also address **CVE-2023-5178** (CVSS 8.8), a use-after-free and double-free flaw in the NVMe/TCP target subsystem that can permit remote code execution or local privilege escalation where NVMe over TCP is enabled, alongside net/sched, netfilter, and other kernel memory-safety defects. Organizations unable to promptly patch CVE-2023-3812 can reduce exposure by preventing the `tun` kernel module from loading; Red Hat identified no standalone mitigation for CVE-2023-5178.
Aug 26, 2026
Red Hat released kernel and live-patch updates for supported Red Hat Enterprise Linux (RHEL) 6, 7, and 8 lifecycle channels to remediate **CVE-2021-0920** and **CVE-2021-4083**. CVE-2021-0920 is a use-after-free flaw in the UNIX-domain socket garbage collector, `unix_gc()`, that can enable local privilege escalation; CVE-2021-4083 is a related file-descriptor lifetime race in `fget()` that can leave garbage-collected socket objects reachable and trigger a read-after-free condition. The fixes were distributed through standard kernel packages and `kpatch-patch` live-kernel modules for affected Extended Update Support, SAP, telecommunications, virtualization, and Real Time offerings. Several advisories also bundled fixes for other privilege-escalation, use-after-free, information-disclosure, and denial-of-service flaws, including CVE-2021-4028, CVE-2022-0330, CVE-2022-0492, and CVE-2022-22942. Administrators should apply the applicable kernel update and reboot systems where required; deployments using the supplied live-patch modules can receive covered fixes without a conventional reboot.
Aug 27, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026