Loading story…
Red Hat released RHSA-2023:7418, an Important-security update for the RHEL 9.2 kpatch-patch live-patching module, remediating eight Linux kernel vulnerabilities across supported x86_64 and ppc64le subscription streams. The RPM automatically loads the live patch after installation, updating vulnerable running kernel code without requiring a conventional reboot-based kernel replacement.
The fixes include CVE-2023-3812 (CVSS 7.8), an out-of-bounds write in the TUN/TAP driver that a low-privileged local user can trigger with an oversized IPv6 packet when NAPI fragments are enabled, potentially causing a crash or privilege escalation. They also address CVE-2023-5178 (CVSS 8.8), a use-after-free and double-free flaw in the NVMe/TCP target subsystem that can permit remote code execution or local privilege escalation where NVMe over TCP is enabled, alongside net/sched, netfilter, and other kernel memory-safety defects. Organizations unable to promptly patch CVE-2023-3812 can reduce exposure by preventing the tun kernel module from loading; Red Hat identified no standalone mitigation for CVE-2023-5178.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:7551 and RHSA-2023:7557 to fix the NVMe/TCP use-after-free vulnerability CVE-2023-5178 in RHEL 8.4 Telecommunications Update Service kernel-rt and Advanced Mission Critical Update Support kernel packages.
Red Hat issued RHSA-2023:7548, RHSA-2023:7549, and RHSA-2023:7554 for RHEL 8 kernel-rt, kernel, and kpatch-patch packages, fixing both the TUN/TAP out-of-bounds issue and the NVMe/TCP use-after-free flaw.
Red Hat released RHSA-2023:7418, a kpatch-patch update for supported RHEL 9.2 offerings. It remediated CVE-2023-3812 and CVE-2023-5178 alongside six other Linux kernel vulnerabilities.
Red Hat issued RHSA-2023:6799 and RHSA-2023:6813 to fix the Linux kernel TUN/TAP oversized-packet flaw, CVE-2023-3812, in RHEL 8.1 Update Services for SAP Solutions kpatch-patch and kernel packages.
Red Hat issued RHSA-2024:1961, RHSA-2024:2006, and RHSA-2024:2008 to fix CVE-2023-3812 in RHEL 8.2 Advanced Update Support, Telecommunications Update Service, and SAP Update Services kernel-related packages.
Red Hat issued RHSA-2024:1268, RHSA-2024:1269, and RHSA-2024:1278 to remediate CVE-2023-5178 in RHEL 8.2 Advanced Update Support, Telecommunications Update Service, and SAP Update Services packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2023:7417**, an Important security advisory supplying updated `kpatch-patch` live-kernel modules for Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions on x86_64 and IBM Power LE (`ppc64le`). The packages cover kernel streams `4.18.0-193.109.1`, `4.18.0-193.113.1`, and `4.18.0-193.116.1`, enabling affected systems to receive the fixes without a kernel reboot. The update remediates four Linux-kernel vulnerabilities: `CVE-2023-1829`, `CVE-2023-3609`, `CVE-2023-3776`, and `CVE-2023-4004`. `CVE-2023-1829` is a use-after-free and potential double-free issue in the traffic-control `tcindex` filter that may let a local attacker obtain root privileges; `CVE-2023-4004` is an Important-severity use-after-free in Netfilter nftables `nft_pipapo_remove()` that a low-privileged local user could trigger to crash a system or escalate privileges. Red Hat rated `CVE-2023-4004` CVSS 7.8 and noted that blocking the affected Netfilter module from loading can mitigate exposure where patching is not immediately possible.
Aug 26, 2026
Red Hat released **Important** kernel security updates and live patches for multiple Red Hat Enterprise Linux versions to remediate several Linux kernel vulnerabilities, including `CVE-2026-43499`, `CVE-2026-46116`, and `CVE-2026-46227`. The updates span standard kernel packages for **RHEL 7 ELS** and **RHEL 9**, as well as **kpatch** live-patch modules for **RHEL 9** and **RHEL 10**, allowing some systems to receive fixes without a reboot. The advisories also bundle additional kernel issues such as `CVE-2026-45984`, `CVE-2026-53166`, `CVE-2026-64531`, and `CVE-2026-31684`, affecting a broad set of x86_64, ppc64le, s390x, and aarch64 product variants, including SAP, EUS, and ELS offerings. The patched flaws include an **rtmutex** bug in `remove_waiter()` that could manipulate the wrong task state during futex proxy locking, an **xfrm** state-deletion bug that triggered slab use-after-free and out-of-bounds writes under repeated list removal, and an **SCTP** `SCTP_SENDALL` iterator flaw that could leave a stale association pointer after the socket lock was dropped, creating use-after-free or type-confusion conditions. Red Hat said fixes were propagated across numerous RHEL 8, 9, and 10 streams and support channels, with standard kernel packages requiring a reboot and `kpatch` updates available for selected RHEL 9 and RHEL 10 kernels.
Aug 25, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026