Loading story…
Red Hat released Important kernel security updates for RHEL 7 Advanced Update Support 7.6 and 7.7 on x86_64, addressing exploitable Linux Traffic Control flaws including CVE-2023-3611 in the Quick Fair Queueing (sch_qfq) scheduler. The out-of-bounds write in qfq_change_agg can allow a local low-privileged user to crash the host or potentially escalate privileges; Red Hat rates it CVSS 7.8. The updates also remediate related traffic-control classifier vulnerabilities, including CVE-2023-3776, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, and CVE-2023-4208.
RHEL 7.6 AUS customers should install kernel build 3.10.0-957.109.1.el7 under RHSA-2024:0261, while RHEL 7.7 AUS customers should deploy 3.10.0-1062.82.1.el7 under RHSA-2024:0262, then reboot systems to activate the patched kernel. A separate QFQ out-of-bounds memory-access issue, CVE-2023-31436, can likewise be triggered locally through an incorrect network-device MTU value and may enable denial of service or privilege escalation. Until patching is complete, Red Hat recommends preventing the sch_qfq kernel module from loading.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:1831 to remediate CVE-2023-3611 and CVE-2023-31436 in Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel packages.
Red Hat issued RHSA-2024:1323, providing a RHEL 7 kpatch-patch fix for CVE-2023-31436.
Red Hat released RHSA-2024:1268 and RHSA-2024:1269 to fix CVE-2023-3611 and CVE-2023-31436 in RHEL 8.2 Advanced Update Support kernel packages and 8.2 Telecommunications Update Service kernel-rt packages.
Red Hat issued RHSA-2024:0999 for RHEL Server 7.7 Advanced Update Support on x86_64, updating the kernel to version 3.10.0-1062.85.1.el7. The update fixes CVE-2023-3609, CVE-2023-4921, CVE-2023-42753, and CVE-2023-45871; affected systems require a reboot.
Red Hat published RHSA-2024:0261 for RHEL 7.6 AUS and RHSA-2024:0262 for RHEL 7.7 AUS, delivering updated kernels that remediate the QFQ vulnerabilities, including CVE-2023-3611 and CVE-2023-31436. The advisories require systems to reboot after installation for the kernel fixes to take effect.
Red Hat issued RHSA-2023:7423 and RHSA-2023:7424 for RHEL 7 kernel and kernel-rt packages, addressing CVE-2023-3611 and CVE-2023-31436. RHSA-2023:7419 also fixed CVE-2023-3611 in RHEL 7 kpatch-patch packages.
Red Hat released RHSA-2023:7077 and RHSA-2023:6901 to fix CVE-2023-3611 and CVE-2023-31436 in Red Hat Enterprise Linux 8 kernel and kernel-rt packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released an Important security update for Red Hat Enterprise Linux Server AUS 7.6 that fixes **CVE-2023-4623**, a CVSS 7.8 use-after-free flaw in the Linux kernel's `net/sched` Hierarchical Fair Service Curve (HFSC) traffic-control component. A local low-privileged attacker could exploit the dangling-pointer condition to escalate privileges when HFSC handles classes using link-sharing curves under a parent without one. RHSA-2024:1747 provides kernel build `3.10.0-957.112.1.el7` and associated packages for affected x86_64 RHEL 7.6 AUS systems; fixes were also issued for affected RHEL 7 and 8 kernel, real-time kernel, and kpatch packages. Administrators should install applicable prior errata and reboot to activate the updated kernel. Until patching is complete, Red Hat recommends blacklisting the `sch_hfsc` module to prevent its automatic loading.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released Important kernel updates for **RHEL 7** and **RHEL for Real Time 7**, delivering `3.10.0-1160.21.1.el7` and `3.10.0-1160.21.1.rt56.1158.el7` respectively. The advisories remediate 11 vulnerabilities, including arbitrary backing-store writes through the LIO SCSI target implementation (`CVE-2020-28374`), a Netfilter conntrack buffer overflow (`CVE-2020-25211`), virtual-terminal and pinctrl use-after-free information disclosures (`CVE-2020-25656`, `CVE-2020-0427`), and a local memory-exhaustion denial of service (`CVE-2021-20265`). The fixes also address an ICMP rate-limiting weakness that can enable off-path UDP-port inference and DNS cache poisoning (`CVE-2020-25705`), as well as flaws reachable through malicious USB devices, including HID-driver out-of-bounds writes (`CVE-2019-19532`). Organizations operating affected RHEL 7, extended-support, virtualization-host, and real-time deployments should install the applicable kernel packages and reboot systems; where patching is delayed, restricting exposure to untrusted USB hardware, LIO exports, and unnecessary Netfilter conntrack-netlink access can reduce risk.
Aug 28, 2026