Loading story…
Red Hat released Moderate-severity advisory RHSA-2024:9500 for Red Hat Enterprise Linux 8.6, updating the kernel to 4.18.0-372.129.1.el8_6. The update remediates three use-after-free flaws: CVE-2022-48695 in the mpt3sas SCSI driver, CVE-2024-26656 in the AMDGPU DRM driver, and CVE-2024-46858 in MPTCP path-manager timer handling.
CVE-2022-48695 arises from incorrect refcount_t handling during mpt3sas controller resets and can allow a low-privileged local attacker to cause a denial of service without user interaction. Affected RHEL 8.6 Extended Life Cycle Long Life, AUS, TUS, and SAP Solutions offerings should install the applicable kernel package and reboot to activate the fixes; Red Hat rates the issue 5.5 CVSS v3.1 based on availability impact, while NVD and cve.org assign 7.8 scores.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:2951 for the RHEL 8 kernel and RHSA-2023:2736 for the RHEL 8 kernel-rt package to remediate CVE-2022-48695.
Red Hat released RHSA-2023:2458 for the RHEL 9 kernel and RHSA-2023:2148 for the RHEL 9 kernel-rt package, fixing the mpt3sas use-after-free vulnerability CVE-2022-48695.
The Linux kernel CVE team documented CVE-2022-48695 as a use-after-free issue in the mpt3sas SCSI driver during controller reset, affecting drivers/scsi/mpt3sas/mpt3sas_scsih.c. It identified fixes in stable kernel releases from 4.9.328 through 6.0 and recommended updating to a current stable release rather than cherry-picking individual commits.
Red Hat published Moderate-severity advisory RHSA-2024:9500, providing kernel version 4.18.0-372.129.1.el8_6 for supported RHEL 8.6 extended-support offerings. The update fixes CVE-2022-48695 along with CVE-2024-26656 and CVE-2024-46858; affected systems require a reboot after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel security updates for RHEL 7.7 Advanced Update Support, RHEL 8 Real Time/NFV and 8.10 Extended Life Cycle, and RHEL 9.0 Update Services for SAP Solutions. The updates remediate an uninitialized HID report-buffer flaw (**CVE-2024-50302**), a use-after-free in CAN BCM processing (**CVE-2023-52922**), and out-of-bounds access risks in ALSA USB-audio support for Extigy and Mbox devices (**CVE-2024-53197**). The RHEL 8 `kernel-rt` update also fixes **CVE-2024-57979**, a PPS subsystem use-after-free that can occur when a PPS source is unregistered while character-device operations remain open, potentially causing memory corruption and kernel panic. Organizations should deploy the applicable fixed packages—including `kernel-rt-4.18.0-553.44.1.rt7.385.el8_10`, `kernel-3.10.0-1062.93.1.el7`, or `kernel-rt-5.14.0-70.125.1.rt21.197.el9_0`—and reboot affected hosts to activate the patched kernel; the advisories do not report known in-the-wild exploitation.
Aug 26, 2026
Red Hat released Important RHEL 8 kernel and `kpatch-patch` updates addressing **CVE-2023-0266**, an ALSA PCM control-element use-after-free vulnerability, and **CVE-2023-0461**, a use-after-free flaw in kernel network ULP handling for listening sockets. The fixes cover RHEL 8.4 EUS, AUS, TUS, Extended Life Cycle Long Life, SAP, and Real Time channels across x86_64, s390x, ppc64le, and aarch64, including kernel version `4.18.0-305.86.2.el8_4` and Real Time version `4.18.0-305.86.2.rt7.160.el8_4` packages. Red Hat also issued a live-patch update for RHEL 8.1 SAP Solutions systems that remediates CVE-2023-0461 and **CVE-2023-1390**, a remotely triggerable denial-of-service flaw in the TIPC module. CVE-2023-1390 can allow an attacker to send two small UDP packets to hosts configured with a UDP TIPC bearer, driving CPU use to 100% and making systems unresponsive. Administrators should install the applicable kernel updates and reboot systems where required; `kpatch-patch` packages apply supported fixes to running kernels without a conventional reboot.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026