Loading story…
Red Hat released Important security updates for Red Hat Enterprise Linux 8 kernel and Real Time kernel deployments, remediating multiple vulnerabilities including CVE-2023-2163, an eBPF verifier-pruning flaw that can permit arbitrary kernel-memory reads and writes, privilege escalation, and container escape. Other fixes address a use-after-free in NVMe-over-TCP crypto cleanup (CVE-2023-5178), an AMD cross-process information disclosure issue (CVE-2023-20593), a DVB Common Interface driver use-after-free (CVE-2022-45919), network scheduler defects, and an SCTP NULL-pointer dereference.
Affected organizations should deploy the applicable RHEL 8 kernel packages, including kernel-rt-4.18.0-513.9.1.rt7.311.el8_9 for covered Real Time offerings and kernel-4.18.0-372.80.1.el8_6 for RHEL 8.6 extended-support systems, then reboot to activate the fixes. Red Hat also delivered a kpatch update for RHEL 8.2 SAP Solutions that mitigates CVE-2023-3812, an oversized-packet flaw in the TUN driver; its live-patch module loads automatically and does not require a conventional reboot. Red Hat notes that exploiting CVE-2023-2163 on RHEL generally requires CAP_SYS_ADMIN or root because unprivileged eBPF is disabled by default.
See real exploitation activity before you spend the cycle.
15 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued an Important kpatch-patch update for RHEL 8.2 Update Services for SAP Solutions, remediating the oversized TUN packet vulnerability CVE-2023-3812. The live-patch module is automatically loaded after installation and modifies the running kernel without a conventional reboot.
Red Hat issued RHSA-2023:7554 to fix CVE-2023-2163 in the RHEL 8 kpatch-patch package.
Red Hat issued an Important kernel-rt update for RHEL 8.4 extended-life-cycle and telecommunications real-time offerings, fixing the NVMe-over-TCP use-after-free CVE-2023-5178 and AMD information-leak issue CVE-2023-20593. The update provided kernel-rt 4.18.0-305.114.1.rt7.190.el8_4 and required a reboot.
Red Hat issued RHSA-2023:7549 to fix CVE-2023-2163 in the standard RHEL 8 kernel package; the advisory also addressed CVE-2022-45919 for RHEL 8.
Red Hat issued an Important update for RHEL 8 kernel-rt packages, fixing CVE-2023-2163, CVE-2023-3812, CVE-2023-5178, and multiple DVB and SMB2 use-after-free vulnerabilities. The update provided kernel-rt 4.18.0-513.9.1.rt7.311.el8_9 and required affected systems to reboot.
Red Hat issued an Important kernel update for RHEL 8.6 extended-support channels, including fixes for DVB use-after-free flaws CVE-2022-45884, CVE-2022-45886, and CVE-2022-45919. The update supplied kernel version 4.18.0-372.80.1.el8_6 and required a reboot.
Guilherme de Almeida Suckevicz reported CVE-2022-45919, a Linux kernel use-after-free condition in dvb_ca_en50221.c that can occur when a device disconnects after being opened without required synchronization.
Red Hat issued RHSA-2024:0563 to fix CVE-2023-2163 in kernel-rt for RHEL 8.4 Telecommunications Update Service.
Red Hat issued RHSA-2024:0562 to remediate CVE-2023-2163 in the kernel for RHEL 8.4 Advanced Mission Critical Update Support.
Red Hat issued RHSA-2024:0403 to fix CVE-2023-2163 in kernels for RHEL 8.2 Advanced Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
Red Hat issued RHSA-2024:0402 to remediate CVE-2023-2163 in kernel-rt for RHEL 8.2 Telecommunications Update Service.
Red Hat released RHSA-2024:0376 to fix CVE-2023-2163 in kpatch-patch for RHEL 8.2 Update Services for SAP Solutions.
Red Hat addressed CVE-2022-45919 for Red Hat Enterprise Linux 8.8 Extended Update Support through RHSA-2023:7539.
Fedora remediated CVE-2022-45919 in its Linux 6.3.7 stable kernel updates.
Linux committed a fix for an eBPF verifier flaw that could incorrectly prune unsafe program paths and allow out-of-bounds reads or writes relative to a BPF map value. The issue, found through fuzzing by Google researchers, was fixed by propagating register-precision dependencies for register-to-register conditional instructions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates across **RHEL 7 Extended Life Cycle Support**, RHEL 8 and its real-time variants, RHEL 9.2 SAP-related lifecycle channels, and RHEL 10. The advisories remediate multiple memory-safety and denial-of-service issues, including use-after-free flaws in the page-pool subsystem (`CVE-2025-38129`) and the teql queueing discipline (`CVE-2026-23074`). The page-pool race can result in a freed page pool being accessed during page recycling and may enable arbitrary code execution; the teql flaw may enable local privilege escalation. Other fixes address buffer overflows, NULL-pointer dereferences, slab out-of-bounds conditions, and flaws in Squashfs, BPF sockmap, SCTP, IPv6, and procfs code paths. Organizations should apply the relevant Red Hat kernel builds, including `4.18.0-553.107.1.el8_10` for affected RHEL 8 deployments and `5.14.0-284.161.1.el9_2` for applicable RHEL 9.2 SAP systems. Red Hat requires affected systems to be rebooted after installation for the updated kernel and mitigations to take effect; teams should prioritize systems where untrusted local users or workloads can access vulnerable kernel functionality.
Aug 28, 2026
Red Hat released Important RHEL 8 kernel and `kpatch-patch` updates addressing **CVE-2023-0266**, an ALSA PCM control-element use-after-free vulnerability, and **CVE-2023-0461**, a use-after-free flaw in kernel network ULP handling for listening sockets. The fixes cover RHEL 8.4 EUS, AUS, TUS, Extended Life Cycle Long Life, SAP, and Real Time channels across x86_64, s390x, ppc64le, and aarch64, including kernel version `4.18.0-305.86.2.el8_4` and Real Time version `4.18.0-305.86.2.rt7.160.el8_4` packages. Red Hat also issued a live-patch update for RHEL 8.1 SAP Solutions systems that remediates CVE-2023-0461 and **CVE-2023-1390**, a remotely triggerable denial-of-service flaw in the TIPC module. CVE-2023-1390 can allow an attacker to send two small UDP packets to hosts configured with a UDP TIPC bearer, driving CPU use to 100% and making systems unresponsive. Administrators should install the applicable kernel updates and reboot systems where required; `kpatch-patch` packages apply supported fixes to running kernels without a conventional reboot.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026