Loading story…
Red Hat released Important security updates for Real Time Linux Kernel packages in Red Hat Enterprise Linux (RHEL) 8.4 and RHEL 9.0 support channels. The updates address multiple kernel memory-safety and logic flaws, including use-after-free vulnerability CVE-2022-3545 in the Netronome NFP driver, NULL-pointer dereference CVE-2023-2166 in the CAN protocol implementation, and an out-of-bounds read/possible privilege-escalation issue, CVE-2023-2176, in the RDMA Connection Manager. They also remediate CVE-2022-38096, a vmwgfx driver NULL-pointer dereference that a local user with access to DRM device nodes could use to crash a host.
Affected deployments include RHEL 9.0 Extended Update Support for SAP Solutions using kernel-rt-5.14.0-70.85.1.rt21.156.el9_0, and RHEL 8.4 Real Time variants using kernel-rt-4.18.0-305.125.1.rt7.201.el8_4, including long-life, telecommunications, and NFV support offerings. The advisories collectively fix additional use-after-free, reference-counting, memory-boundary, networking, netfilter, and local privilege-escalation defects; organizations should apply the applicable kernel-rt update and reboot affected systems to activate the fixes.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important advisory RHSA-2024:1382 for RHEL 8.4 Real Time offerings, providing kernel-rt 4.18.0-305.125.1.rt7.201.el8_4. The advisory fixed CVE-2022-3545, CVE-2022-38096, CVE-2023-2166, CVE-2023-2176, and other kernel defects; affected systems required a reboot.
Red Hat issued Important advisory RHSA-2024:0563 for specialized RHEL 8.4 Real Time services, providing kernel-rt version 4.18.0-305.120.1.rt7.196.el8_4. The update fixed 11 vulnerabilities, including eBPF verifier, use-after-free, netfilter, Intel GDS, and networking-driver flaws; systems required a reboot after installation.
Red Hat issued Important advisory RHSA-2024:0431 for RHEL 9.0 Extended Update Support kernel-rt packages, delivering version 5.14.0-70.85.1.rt21.156.el9_0. The update remediated ten listed kernel vulnerabilities and required a reboot to take effect.
Red Hat addressed CVE-2022-38096 through 2024 advisories for RHEL 8 and 9, including Extended Update Support, Advanced Update Support, Telecommunications Update Service, and SAP Solutions channels.
Red Hat addressed CVE-2023-2176 across RHEL 8 and 9 product streams, including Extended Update Support and specialized support variants. The flaw can corrupt the CMA ID tree and cause an out-of-bounds condition in compare_netdev_and_ip.
Red Hat issued fixes for CVE-2023-2166 across multiple RHEL 8 and 9 support streams, including Extended Update Support and specialized support variants.
Red Hat addressed CVE-2022-3545 in multiple RHEL 8 and 9 support streams, including standard, Extended Update Support, Advanced Update Support, Telecommunications Update Service, SAP Solutions, and Mission Critical Update Support channels.
Rohit Keshri was identified in documentation for CVE-2023-2166, a NULL-pointer dereference in the Linux CAN receive path. The uninitialized ml_priv member could allow a local user to crash the system.
The use-after-free issue later tracked as CVE-2022-3545 was referenced in ipsec-next commit 02e1a114fdb71e59ee6770294166c30d437bf86a. The flaw affects area_cache_get in the Netronome NFP driver.
Mauro Matteo Cascella documented CVE-2022-38096, a NULL-pointer dereference in the Linux kernel vmwgfx driver's vmw_cmd_dx_define_query function. A local unprivileged user with access to the applicable DRM device could potentially crash an affected system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated kernel and real-time kernel updates for affected RHEL 8.2 Advanced Update Support, Telecommunications Update Service, SAP Solutions, Real Time, and Real Time for NFV deployments. The updates remediate seven Linux kernel flaws, including `CVE-2023-4459`, a NULL-pointer dereference in the `vmxnet3` network driver that can allow a local user to crash a system through an MTU-change error path, and `CVE-2023-7192`, a Netfilter connection-tracking reference-count leak that a local attacker with `CAP_NET_ADMIN` can exploit to cause denial of service. The advisories also address use-after-free, stack-corruption, divide-error, oversized-packet handling, and membarrier resource-exhaustion conditions. Organizations using the affected non-real-time kernel should deploy build `4.18.0-193.133.1.el8_2`; affected real-time environments should install the applicable updated `kernel-rt` packages. Systems must be rebooted after installation for the kernel fixes to take effect.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026