Loading story…
CVE-2022-30594 affects Linux kernels before 5.17.2, where the PTRACE_SEIZE path improperly permits a low-privileged local user to set PTRACE_O_SUSPEND_SECCOMP. This bypasses intended controls on suspending seccomp protections and can weaken process sandboxing. The upstream fix is commit ee1fee900537b5d9560e9f937402de5ddc8412f3; Red Hat rates the issue Moderate (CVSS 5.5), while NVD assigns CVSS 7.8.
Red Hat released fixes for RHEL 8, RHEL 8.6 EUS, and RHEL 9, including kernel-rt-5.14.0-70.30.1.rt21.102.el9_0 through RHSA-2022:7319; affected systems require a reboot after updating. RHEL 6 and 7 are marked will not fix. Where patches cannot be deployed or ptrace is not required, Red Hat recommends disabling ptrace with the SELinux deny_ptrace boolean or setting kernel.yama.ptrace_scope to 3.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:2736 for affected RHEL 8 kernel-rt packages and RHSA-2023:2951 for affected RHEL 8 kernel packages, addressing CVE-2022-30594.
Red Hat issued RHSA-2023:0300 for RHEL 9 x86_64 Real Time Linux Kernel packages, providing kernel-rt version 5.14.0-162.12.1.rt21.175.el9_1 and fixing CVE-2022-30594 alongside five other kernel vulnerabilities. Red Hat instructed affected systems to reboot after installing the update.
Red Hat issued RHSA-2022:7318 for updated RHEL 9 Linux kernel packages, remediating CVE-2022-30594 and CVE-2022-2585 alongside other kernel fixes. Administrators were instructed to reboot after installing the update.
Red Hat issued RHSA-2022:7319 for RHEL 9 kernel-rt, supplying version 5.14.0-70.30.1.rt21.102.el9_0 and addressing CVE-2022-30594. Affected systems required a reboot after installation for the fix to take effect.
Anten Skrabec reported CVE-2022-30594, a Linux kernel issue in which unprivileged users could use PTRACE_SEIZE to bypass restrictions on the PTRACE_O_SUSPEND_SECCOMP option.
RHSA-2024:0412 fixed CVE-2022-30594 in the RHEL 8.6 Extended Update Support kernel and the Red Hat Virtualization 4 kernel for RHEL 8.
Red Hat closed Bugzilla 2085300, its tracking case for CVE-2022-30594.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-56675** is a use-after-free flaw in Linux kernel eBPF tracing introduced in kernel 6.0. Non-sleepable BPF programs attached to uprobes could be freed after a normal RCU grace period while uprobe execution still accessed them under tasks-trace-RCU protection, creating an unsafe lifetime mismatch. The upstream fix waits for a tasks-trace-RCU grace period after removing the BPF attachment from its `perf_event`; fixed stable releases include 6.1.121, 6.6.67, 6.12.6, and 6.13-rc3. Red Hat rated the issue **Moderate** (CVSS 6.7) because default RHEL configurations disable unprivileged eBPF, requiring `CAP_SYS_ADMIN` or root privileges to exploit it. Fixes are available for RHEL 9 and RHEL 10 through RHSA-2025:20518 and RHSA-2025:20095, respectively; RHEL 9 kernel-rt remains affected, while RHEL 6, RHEL 8, and RHEL 8 kernel-rt are not affected. Organizations should deploy the applicable kernel update, with particular attention to systems where privileged users can load or attach eBPF programs.
Aug 26, 2026
**CVE-2025-38352** is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between `handle_posix_cpu_timers()` and `posix_cpu_timer_del()` while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available. Red Hat released fixes across affected kernel packages, including `kernel-rt-4.18.0-553.74.1.rt7.415.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
Aug 26, 2026
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026