Loading story…
Red Hat released RHEL 8 and RHEL 9 kernel updates to remediate a use-after-free race condition in the Linux kernel Qualcomm EMAC Gigabit Ethernet Controller driver's emac_remove path. Removing a Qualcomm EMAC device before driver cleanup can leave freed memory accessible, potentially causing a system crash or other undefined behavior. The upstream fix, “net: qcom/emac: fix UAF in emac_remove,” is present in kernel versions 4.9.277, 4.14.241, 4.19.199, 5.4.135, 5.10.53, 5.13.5, and later.
Red Hat tracks the issue as CVE-2023-33203 with a CVSS v3.1 score of 6.4 and as CVE-2021-47311 in its kernel bug record. Exploitation requires physical access and high attack complexity, limiting remote exposure, but organizations using systems with Qualcomm EMAC hardware should apply the relevant RHEL 8, RHEL 8.6/8.8 extended-support, and RHEL 9 kernel advisories. RHEL 6 and RHEL 7 are unaffected because they do not include Qualcomm EMAC support; RHEL 9 kernel-rt was listed as affected without a corresponding erratum.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
A Red Hat security bug for CVE-2021-47311, a use-after-free flaw in the Qualcomm EMAC driver's emac_remove path, was reported. The issue had an upstream fix titled "net: qcom/emac: fix UAF in emac_remove."
Red Hat addressed CVE-2021-47311 for RHEL 8 and supported extended-support variants through RHSA-2024:4211, RHSA-2024:4352, RHSA-2024:4740, and RHSA-2024:5281. The latter also covered RHEL 8.6 Update Services for SAP Solutions and Telecommunications Update Service.
Red Hat released RHSA-2023:6901 for the RHEL 8 kernel-rt package and RHSA-2023:7077 for the RHEL 8 kernel package, addressing CVE-2023-33203.
Red Hat released RHSA-2023:6583 to fix the Qualcomm EMAC emac_remove use-after-free issue in the RHEL 9 kernel package.
Red Hat released RHSA-2024:0575 to fix CVE-2023-33203 in RHEL 8.8 Extended Update Support.
RHSA-2024:0412 addressed CVE-2023-33203 for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel security updates for RHEL 8.4 extended-support channels and RHEL 9.0 Extended Update Support to remediate **CVE-2022-4139** and **CVE-2022-2964**. CVE-2022-4139 affects Intel Gen12 i915 GPUs: an incorrect GPU TLB flush can leave stale mappings that enable random memory access, potentially resulting in data exposure or memory corruption. CVE-2022-2964 is a memory-corruption vulnerability in handling AX88179_178A USB Ethernet devices. Affected organizations should install kernel `4.18.0-305.76.1.el8_4` on applicable RHEL 8.4 deployments and `5.14.0-70.43.1.el9_0` on applicable RHEL 9.0 EUS systems, then reboot to activate the fixes. Red Hat also delivered the fixes through its RHEL 9 live-kernel-patching package, alongside remediation for a watch-queue privilege-escalation race condition and an `nfsd` TCP/RPC buffer-overflow flaw; the live patch is available for x86_64 and little-endian Power RHEL 9 systems.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated RHEL 9 kernel and real-time kernel updates that remediate a broad set of Linux kernel vulnerabilities across networking, traffic control, XFRM, IPv6, USB, Wi-Fi, memory management, and virtualization components. The updates include `kernel-rt-5.14.0-284.11.1.rt14.296.el9_2` for x86_64 and corresponding standard kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 9 deployments, including EUS, ELS, SAP, AUS, and CodeReady variants. Notable fixes include races and memory-safety flaws tracked as `CVE-2022-3028`, `CVE-2022-3567`, `CVE-2022-3522`, `CVE-2022-4129`, `CVE-2022-43750`, `CVE-2022-47929`, `CVE-2023-0394`, and `CVE-2023-0590`. Impacts range from local denial of service and kernel-information disclosure to potential privilege escalation; `CVE-2022-3628` can be triggered through a malicious USB device against the `brcmfmac` Wi-Fi driver. Organizations should apply the applicable supported RHEL kernel errata, reboot systems to activate the new kernel, and, where patching `CVE-2022-3628` is not immediately possible, prevent loading the `brcmfmac` module.
Aug 26, 2026