Loading story…
Red Hat released RHSA-2024:0461 for Red Hat Enterprise Linux 9, updating the kernel to remediate 17 security vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The Important-rated advisory affects RHEL 9 and supported update-service variants on x86_64, ARM64, IBM Z, and IBM Power little-endian systems; administrators must reboot after applying the updated kernel.
Among the fixes is CVE-2023-3777, a CVSS 7.8 use-after-free flaw in the Linux nf_tables netfilter component. A local attacker with CAP_NET_ADMIN in a user or network namespace could exploit improper bound-chain validation in nf_tables_delrule() to escalate privileges. Red Hat fixed affected RHEL 9 and selected RHEL 9 Extended Update Support kernel and real-time kernel packages, while RHEL 6, 7, and 8 are not affected; pending patching, organizations can prevent the netfilter module from loading and, where operationally feasible, disable user namespaces on non-containerized systems.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat listed CVE-2023-3777 as fixed for RHEL 9 and RHEL 9.0 and 9.2 Extended Update Support kernel and kernel-rt packages through errata RHSA-2024:0461, RHSA-2024:0431, RHSA-2024:0432, RHSA-2024:0439, and RHSA-2024:0448.
Red Hat issued the Important-rated RHSA-2024:0461 advisory, providing an updated RHEL 9 kernel that remediated 17 vulnerabilities, including CVE-2023-3777. The update required a reboot to take effect.
A use-after-free vulnerability in the Linux kernel netfilter nf_tables component was reported. The flaw can permit local privilege escalation when nf_tables_delrule() flushes rules without confirming that a chain is bound.
Red Hat documented CVE-2023-4015, a Linux kernel netfilter nf_tables use-after-free issue in which nft_immediate_deactivate() can unbind chains and objects during nftables rule-construction error handling before they are later used. The issue was fixed upstream by commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 and addressed for RHEL 9 and RHEL 9.2 EUS through RHSA-2024:0461, RHSA-2024:0439, and RHSA-2024:0448.
The upstream remediation, commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8, was included in Linux kernel 6.5-rc3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released moderate-severity updates for the standard Linux kernel and Real Time Linux Kernel in **RHEL 9**, delivering `kernel-rt-5.14.0-162.6.1.rt21.168.el9_1` for x86_64 and corresponding kernel packages across x86_64, ARM64, IBM Z, and Power. The updates remediate numerous vulnerabilities, including memory-safety defects that could enable local privilege escalation, information disclosure, denial of service, out-of-bounds writes, TCP session injection or termination, and AMD and Intel speculative-execution issues including RetBleed-related weaknesses. Among the fixed flaws is **CVE-2022-1016**, a Netfilter/nf_tables defect in `nft_do_chain()` in which uninitialized stack registers could leak kernel pointers to userspace. The upstream fix initializes those registers; Red Hat shipped remediations for RHEL 8 and 9 through multiple advisories. Organizations running affected RHEL 9 standard or real-time kernels should apply the relevant updates and reboot systems, as the kernel fixes do not take effect until restart.
Aug 26, 2026
Red Hat addressed **CVE-2023-35001**, a high-severity out-of-bounds memory-access vulnerability in the Linux kernel Netfilter `nf_tables` implementation, specifically the `nft_byteorder_eval()` function. Failed bounds checking and incorrect data alignment can allow an attacker holding `CAP_NET_ADMIN` in a user or network namespace to escalate privileges locally; Red Hat assigned a CVSS v3.1 score of 7.8, with high impacts to confidentiality, integrity, and availability. Affected Red Hat Enterprise Linux 7 and 8 kernel, real-time kernel, and kpatch packages received fixes through 2023 advisories. RHSA-2023:7243 supplies fixed `3.10.0-1062.80.1.el7` kernel packages for RHEL 7.7 AUS on x86_64; organizations must reboot after installation. Until updates can be deployed, Red Hat recommends blacklisting the affected Netfilter kernel module to prevent it from loading.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026