Loading story…
Red Hat released RHSA-2023:4801, an Important security and bug-fix update for Red Hat Enterprise Linux 9.0 Extended Update Support and selected SAP Update Services channels. The 5.14.0-70.70.1.el9_0 kernel packages remediate five disclosed flaws, including an ipvlan out-of-bounds write, a PF_KEY information leak, a TLS use-after-free or NULL-pointer dereference, and the stale-TLB race tracked as CVE-2022-39188. That flaw can let a device driver free a page while stale TLB entries remain during a race between unmap_mapping_range() and munmap() on VM_PFNMAP memory areas.
The update also fixes CVE-2023-0458, a speculative pointer-dereference issue in do_prlimit() that a locally authenticated low-privilege attacker could potentially use to leak kernel memory by controlling resource-related pointer arithmetic. Red Hat rated both issues moderate severity at CVSS 4.7 and did not identify a qualifying standalone mitigation; affected organizations should install the relevant kernel errata and reboot systems to load the patched kernel.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHEL 8 kernel and kernel-rt updates addressing CVE-2023-0458 through RHSA-2023:7077 and RHSA-2023:6901.
Red Hat published RHSA-2023:4814 for the RHEL 9.0 EUS Real Time Linux Kernel on x86_64 SAP Solutions systems. The kernel-rt update fixed CVE-2023-0458, CVE-2022-39188, and three other kernel vulnerabilities; affected systems require a reboot after installation.
Red Hat addressed the do_prlimit() speculative pointer-dereference vulnerability in RHEL 9 kernel and kernel-rt packages through RHSA-2023:4377 and RHSA-2023:4378.
Guilherme de Almeida Suckevicz documented a heap out-of-bounds write in the Linux kernel ipvlan driver caused by uninitialized skb->cb. The flaw is reachable with CONFIG_IPVLAN enabled and can permit local privilege escalation.
Red Hat issued fixes for CVE-2022-39188 in RHEL 8 kernel-rt and kernel packages through RHSA-2023:2736 and RHSA-2023:2951.
Red Hat released RHEL 9 kernel and kernel-rt fixes for the stale-TLB use-after-free vulnerability through RHSA-2023:2458 and RHSA-2023:2148.
Guilherme de Almeida Suckevicz reported the speculative pointer-dereference vulnerability in the Linux kernel's do_prlimit() function. The flaw could allow a low-privileged local attacker to potentially leak memory contents.
RHSA-2024:0724 fixed CVE-2023-0458 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
RHSA-2024:0575 addressed CVE-2023-0458 for the RHEL 8.8 Extended Update Support kernel.
Red Hat published RHSA-2023:4801, providing kernel version 5.14.0-70.70.1.el9_0 for RHEL 9.0 EUS and selected SAP channels. The update addressed CVE-2022-39188, CVE-2023-0458, and other disclosed kernel vulnerabilities; Red Hat instructed affected organizations to reboot after installation.
RHSA-2023:3388 fixed the stale-TLB race vulnerability for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat closed its CVE-2022-1353 bug after issuing fixes for affected RHEL 8, RHEL 8 EUS, RHEL 9, and RHEL 9.0 EUS releases. The Linux kernel pfkey_register flaw could allow an unprivileged local user to access kernel memory, crash the system, or disclose internal information.
Linux kernel 5.19 included upstream commit b67fbebd4cf980aecbcc750e1462128bffe8ae15, fixing a race between munmap() and unmap_mapping_range() that could leave stale TLB entries for VM_PFNMAP mappings and permit access to freed pages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugs.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Moderate-severity kernel updates for RHEL 9.2 servicing streams, including Extended Update Support, Update Services for SAP Solutions, and Extended Life Cycle offerings, to remediate **CVE-2024-25744** and **CVE-2023-52628**. CVE-2024-25744 allows an untrusted virtual-machine monitor to trigger `int80` system-call handling at arbitrary points in affected Linux kernels, impacting Intel TDX confidential-computing and AMD memory-encryption-related code; upstream fixed it in Linux 6.6.7. CVE-2023-52628 is a four-byte out-of-bounds stack write in netfilter/nftables extended-header processing, with potential remote reachability requiring environment-specific validation. RHSA-2024:2845 supplies kernel version `5.14.0-284.66.1.el9_2` for supported RHEL 9.2 architectures, while RHSA-2024:2846 provides the real-time kernel `5.14.0-284.66.1.rt14.351.el9_2` for affected x86_64 deployments; administrators must reboot after installing the updates.
Aug 26, 2026
Red Hat released **Important** kernel and Real Time kernel updates for Red Hat Enterprise Linux 9.0 Extended Update Support, remediating six Linux kernel vulnerabilities. The flaws include multiple use-after-free conditions, an out-of-bounds access in XFS, a kernel-pointer information disclosure issue in nftables processing, and unauthorized execution of Bluetooth management commands. Affected packages include `kernel-5.14.0-70.64.1.el9_0` for x86_64, s390x, ppc64le, and aarch64 deployments, and `kernel-rt-5.14.0-70.64.1.rt21.135.el9_0` for supported x86_64 SAP Solutions systems. One fixed issue, **CVE-2023-2235**, is a use-after-free vulnerability in the Performance Events subsystem that may allow a local attacker to escalate privileges. The defect in `perf_group_detach()` could leave a dangling pointer when `remove_on_exec` invokes `list_del_event()` before group detachment; upstream corrected it in commit `fd0815f632c24878e325821943edccc7fde947a2`. Organizations using affected RHEL 9.0 EUS systems should install the applicable updated kernel packages and reboot hosts to activate the fixes.
Aug 26, 2026