Loading story…
Red Hat released the Moderate-severity RHSA-2024:1653 kernel update for RHEL 8.6 Update Services for SAP Solutions and other applicable RHEL 8.6 variants. The update fixes CVE-2023-1118, a use-after-free race condition in the Linux ENE integrated infrared receiver/transceiver driver (drivers/media/rc/ene_ir.c) that could allow a local low-privileged attacker to crash a system or potentially escalate privileges when an RC device is detached.
Affected administrators should deploy kernel version 4.18.0-372.98.1.el8_6 on supported x86_64, s390x, ppc64le, and aarch64 systems, apply prerequisite errata, and reboot to activate the new kernel. The advisory also addresses CVE-2021-33631 in ext4 and CVE-2024-26602 affecting sys_membarrier; RHEL 9 is not affected by the ENE issue because the CONFIG_IR_ENE driver is not built.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:6901 for RHEL 8 kernel-rt and RHSA-2023:7077 for the RHEL 8 kernel, remediating the ENE infrared-driver use-after-free vulnerability CVE-2023-1118.
Linux commit 29b0589 fixed use-after-free races in the ENE infrared remote-control driver during device removal. The patch unregisters the RC device and synchronously cancels the transmit simulation timer before releasing IRQ, I/O, and device-memory resources.
Red Hat released RHSA-2024:3810 to fix CVE-2023-1118 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Red Hat published RHSA-2024:1653, a Moderate-severity kernel update for RHEL 8.6 update-service variants. The update, containing kernel version 4.18.0-372.98.1.el8_6, fixes CVE-2023-1118 along with CVE-2021-33631 and CVE-2024-26602.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updated Linux kernels for RHEL 8 Extended Update Support deployments that remediate **CVE-2022-41674**, a medium-severity `cfg80211_update_notlisted_nontrans()` flaw. An attacker-controlled MBSSID length can trigger an 8-bit integer overflow, causing `memcpy()` to write up to 256 bytes beyond an allocated buffer. The fixes were delivered for RHEL 8.6 EUS in **RHSA-2024:1188**, which provides kernel `4.18.0-372.95.1.el8_6` across x86_64, s390x, ppc64le, and aarch64 systems. The RHEL 8 EUS kernel advisories also address **CVE-2021-4204**, an eBPF input-validation defect that permits out-of-bounds kernel memory access. A locally privileged attacker could use the issue to crash a host or disclose internal kernel data. Red Hat’s RHEL 8.8 EUS advisory, **RHSA-2024:10262**, provides kernel `4.18.0-477.81.1.el8_8` and fixes 22 kernel CVEs, including eBPF memory-safety, privilege-escalation, race, and buffer-corruption issues. Administrators should install the applicable kernel packages and reboot systems for the mitigations to take effect.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released Important-rated RHEL 8 kernel security updates addressing flaws in the iMON media remote-control driver, Ceph client, SCTP, SMB/CIFS client, EFI variable filesystem, and other kernel components. The primary defects include a use-after-free caused by a disconnect race in `imon_disconnect()` (**CVE-2025-39993**), a libceph use-after-free during session initialization (**CVE-2025-68285**), an SMB-client rename race (**CVE-2025-39825**), and an out-of-bounds read in `efivarfs_d_compare` (**CVE-2025-39817**). The iMON and Ceph issues stem from unsynchronized access to device or map pointers; upstream fixes add disconnected-state validation and locking around protected data. Advisories **RHSA-2026:0443** and **RHSA-2026:0444** provide kernel and kernel-rt version `4.18.0-553.92.1` for supported RHEL 8 and RHEL 8.10 Extended Life Cycle streams, remediating CVE-2025-39993, CVE-2025-68285, and SCTP NULL-pointer dereference CVE-2025-40240. **RHSA-2026:0533** updates RHEL 8.4 Advanced Update Support and Extended Life Cycle Long Life deployments with `4.18.0-305.183.1.el8_4` or later, addressing 12 kernel issues including SMB, EFI, media, and Ceph vulnerabilities. Organizations should apply the applicable package update and reboot affected systems to activate the patched kernel.
Aug 26, 2026