Loading story…
Red Hat released an Important security update for Red Hat Enterprise Linux Server AUS 7.6 that fixes CVE-2023-4623, a CVSS 7.8 use-after-free flaw in the Linux kernel's net/sched Hierarchical Fair Service Curve (HFSC) traffic-control component. A local low-privileged attacker could exploit the dangling-pointer condition to escalate privileges when HFSC handles classes using link-sharing curves under a parent without one.
RHSA-2024:1747 provides kernel build 3.10.0-957.112.1.el7 and associated packages for affected x86_64 RHEL 7.6 AUS systems; fixes were also issued for affected RHEL 7 and 8 kernel, real-time kernel, and kpatch packages. Administrators should install applicable prior errata and reboot to activate the updated kernel. Until patching is complete, Red Hat recommends blacklisting the sch_hfsc module to prevent its automatic loading.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released fixes for affected RHEL 7 kernel, kernel-rt, and kpatch-patch packages through RHSA-2024:2004, RHSA-2024:2003, and RHSA-2024:1960.
Red Hat published Important advisory RHSA-2024:1747 for RHEL Server AUS 7.6 on x86_64, supplying kernel build 3.10.0-957.112.1.el7 to remediate the HFSC use-after-free flaw. The advisory instructed administrators to reboot after applying the update.
Red Hat issued kernel and kernel-rt fixes for affected RHEL 8.2 Advanced Update Support and 8.2 Telecommunications Update Service packages through RHSA-2024:1268 and RHSA-2024:1269.
Red Hat released fixes for CVE-2023-4623 in Red Hat Enterprise Linux 8 kernel, kernel-rt, and kpatch-patch packages through RHSA-2024:0897, RHSA-2024:0881, and RHSA-2024:0876.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released an **Important** update, `RHSA-2025:15786`, for Red Hat Enterprise Linux 8 Real Time kernel packages to remediate three kernel flaws: `CVE-2025-38350` in `net/sched`, `CVE-2025-38392` in the IDPF driver control queue, and `CVE-2025-38449` in DRM/GEM framebuffer-handle reference management. The advisory affects RHEL for Real Time 8, Real Time for NFV 8, and x86_64 Extended Life Cycle 8.10; the fixed package is `kernel-rt-4.18.0-553.75.1.rt7.416.el8_10`. `CVE-2025-38350` is a use-after-free in the Credit-Based Shaper (`sch_cbs`) queuing discipline. Improper reset handling can leave queue lengths inconsistent and trigger a use-after-free in a parent HFSC scheduler during interface resets. Red Hat rates the issue CVSS 7.0, while NVD and cve.org rate it 7.8; on RHEL 8 and later, non-root users may be able to exploit it through unprivileged user namespaces. Organizations should deploy the updated kernel packages and reboot affected hosts; where patching cannot occur promptly, prevent the `sch_cbs` module from loading.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 7 Advanced Update Support 7.6 and 7.7 on x86_64, addressing exploitable Linux Traffic Control flaws including **CVE-2023-3611** in the Quick Fair Queueing (`sch_qfq`) scheduler. The out-of-bounds write in `qfq_change_agg` can allow a local low-privileged user to crash the host or potentially escalate privileges; Red Hat rates it CVSS 7.8. The updates also remediate related traffic-control classifier vulnerabilities, including **CVE-2023-3776**, **CVE-2023-4128**, **CVE-2023-4206**, **CVE-2023-4207**, and **CVE-2023-4208**. RHEL 7.6 AUS customers should install kernel build `3.10.0-957.109.1.el7` under RHSA-2024:0261, while RHEL 7.7 AUS customers should deploy `3.10.0-1062.82.1.el7` under RHSA-2024:0262, then reboot systems to activate the patched kernel. A separate QFQ out-of-bounds memory-access issue, **CVE-2023-31436**, can likewise be triggered locally through an incorrect network-device MTU value and may enable denial of service or privilege escalation. Until patching is complete, Red Hat recommends preventing the `sch_qfq` kernel module from loading.
Aug 26, 2026
Red Hat released Important kernel security updates for affected Red Hat Enterprise Linux 7 and 8 streams, including RHEL Server AUS 8.2, to remediate **CVE-2024-36971**, a known-exploited use-after-free flaw in Linux kernel network route management. A local low-privileged attacker could alter the behavior of certain network connections, potentially affecting confidentiality, integrity, and availability; Red Hat rated the issue CVSS 7.8. For RHEL Server AUS 8.2 on x86_64, RHSA-2024:5388 provides kernel version `4.18.0-193.138.1.el8_2`; systems must be rebooted after installation. Red Hat reported no practical mitigation and recommends prompt patching. Organizations using third-party KABI modules should validate compatibility, as modules that call `negative_advice()` may crash after the update and should be updated by their vendors or disabled until corrected.
Aug 27, 2026