Loading story…
Red Hat addressed a Linux kernel race condition in UNIX-domain socket handling that can trigger a use-after-free in sk_receive_queue. During garbage collection, an skb can be unlinked and freed while unix_stream_sendpage() still accesses it; the issue is associated with upstream commit 790c2f9d15b594350ae9bca7b236f2b1859de02c and is tracked as BZ#2230094. The flaw is also covered by CVE-2023-4623 in RHEL 9.2 live-patch guidance.
Affected organizations should apply the applicable Red Hat kernel or kernel-rt updates across supported RHEL 8 and RHEL 9 specialized, telecommunications, SAP, and extended-lifecycle channels. RHSA-2024:0403 supplies kernel-4.18.0-193.120.1.el8_2 for eligible RHEL 8.2 systems, while RHSA-2024:0402, RHSA-2024:0134, RHSA-2024:0439, and RHSA-2024:0563 provide related Real Time kernel fixes; systems must be rebooted after kernel installation. RHEL 9.2 customers using live patching can install the updated kpatch-patch packages from RHSA-2024:0381 for the affected vulnerability set.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2024:9943 for the RHEL 9.0 SAP Solutions x86_64 channel. The kernel-rt update remediates CVE-2024-26671, CVE-2022-48796, and CVE-2024-46858; affected systems must be rebooted after installation.
Red Hat issued Important-rated RHSA-2024:5261 for RHEL Server AUS 7.7 x86_64. Kernel version 3.10.0-1062.90.1.el7 remediates CVE-2023-4622 in AF_UNIX unix_stream_sendpage() and CVE-2024-36971, the network route-management use-after-free known as Beaky Buzzard; systems must reboot after applying the update.
Red Hat issued RHSA-2024:1960, an Important advisory, providing updated kpatch-patch live kernel modules for RHEL 7 x86_64 and ppc64le product lines. The live patch remediated CVE-2023-4622 in unix_stream_sendpage and CVE-2023-4623 in sch_hfsc without requiring a conventional kernel reboot.
The Linux kernel CVE team assigned CVE-2024-26671 to an sbitmap wakeup race in the blk-mq block multiqueue subsystem. The race can cause an I/O hang and was resolved upstream by the "blk-mq: fix IO hang from sbitmap wakeup race" patch.
Red Hat issued RHSA-2024:0439 for RHEL 9.2 SAP Solutions and Extended Life Cycle subscriptions. Kernel-rt version 5.14.0-284.48.1.rt14.333.el9_2 addressed the BZ#2230094 Unix-socket race condition, with a reboot required after installation.
Red Hat issued RHSA-2024:0402 and RHSA-2024:0403 for RHEL 8.2 Telecommunications, Advanced Update Support, and SAP-related channels. The kernel and kernel-rt updates addressed BZ#2230094's Unix-socket sk_receive_queue use-after-free race and required affected systems to reboot.
Red Hat marked Bugzilla issue BZ#2230094, involving a Unix-domain socket sk_receive_queue race that could cause a use-after-free, as a duplicate of BZ#2237760.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel and live-patch updates for supported Red Hat Enterprise Linux (RHEL) 6, 7, and 8 lifecycle channels to remediate **CVE-2021-0920** and **CVE-2021-4083**. CVE-2021-0920 is a use-after-free flaw in the UNIX-domain socket garbage collector, `unix_gc()`, that can enable local privilege escalation; CVE-2021-4083 is a related file-descriptor lifetime race in `fget()` that can leave garbage-collected socket objects reachable and trigger a read-after-free condition. The fixes were distributed through standard kernel packages and `kpatch-patch` live-kernel modules for affected Extended Update Support, SAP, telecommunications, virtualization, and Real Time offerings. Several advisories also bundled fixes for other privilege-escalation, use-after-free, information-disclosure, and denial-of-service flaws, including CVE-2021-4028, CVE-2022-0330, CVE-2022-0492, and CVE-2022-22942. Administrators should apply the applicable kernel update and reboot systems where required; deployments using the supplied live-patch modules can receive covered fixes without a conventional reboot.
Aug 27, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released kernel and live-patch updates across supported RHEL 8 and RHEL 9 service streams to remediate **CVE-2023-3609**, a use-after-free flaw in the Linux `net/sched` `cls_u32` traffic-control classifier. A local attacker able to manipulate a filter reference count could trigger an error path in `u32_set_parms()`, free an object, and subsequently use it, potentially achieving local privilege escalation. The upstream correction is associated with commit `04c55383fa5689357bcdd2c8036725a55ed632bc`. Affected offerings include RHEL 8.2, 8.4, 8.6, and 8.8 update-service variants, plus RHEL 9.0 and 9.2—including Real Time, SAP, AUS, TUS, EUS, and extended-lifecycle channels. Relevant fixed builds include RHEL 9.2 kernel `5.14.0-284.40.1.el9_2`, RHEL 8.8 kernel `4.18.0-477.36.1.el8_8`, and RHEL 8.6 kernel `4.18.0-372.75.1.el8_6`; Red Hat also supplied `kpatch-patch` live updates for certain RHEL 8.6 and 8.8 deployments. Administrators should install the applicable errata and reboot systems unless deploying the supported live-patch package.
Aug 26, 2026