Loading story…
Red Hat released moderate-severity updates for the standard Linux kernel and Real Time Linux Kernel in RHEL 9, delivering kernel-rt-5.14.0-162.6.1.rt21.168.el9_1 for x86_64 and corresponding kernel packages across x86_64, ARM64, IBM Z, and Power. The updates remediate numerous vulnerabilities, including memory-safety defects that could enable local privilege escalation, information disclosure, denial of service, out-of-bounds writes, TCP session injection or termination, and AMD and Intel speculative-execution issues including RetBleed-related weaknesses.
Among the fixed flaws is CVE-2022-1016, a Netfilter/nf_tables defect in nft_do_chain() in which uninitialized stack registers could leak kernel pointers to userspace. The upstream fix initializes those registers; Red Hat shipped remediations for RHEL 8 and 9 through multiple advisories. Organizations running affected RHEL 9 standard or real-time kernels should apply the relevant updates and reboot systems, as the kernel fixes do not take effect until restart.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:3708 for RHEL 9 x86_64 Real Time Linux Kernel version 5.14.0-284.18.1.rt14.303.el9_2. The update fixed six kernel vulnerabilities, including CVE-2023-32233 in netfilter nf_tables, and required affected systems to be rebooted.
Red Hat issued Moderate-severity advisory RHSA-2022:8267 for the standard RHEL 9 kernel across x86_64, ARM64, IBM Z, and Power offerings. It fixed CVE-2022-1016 and other memory-safety, network, denial-of-service, and CPU speculative-execution vulnerabilities, with a reboot required after installation.
Red Hat issued Moderate-severity advisory RHSA-2022:7933 for RHEL 9 kernel-rt, delivering version 5.14.0-162.6.1.rt21.168.el9_1 for x86_64. The update remediated numerous kernel flaws, including CVE-2022-1016 and speculative-execution issues; affected systems require rebooting.
Red Hat remediated CVE-2022-20572, a dm-verity missing-permission-check flaw that can permit modification of read-only files and local privilege escalation, through RHSA-2022:7444 for RHEL 8 kernel-rt and RHSA-2022:7683 for the standard RHEL 8 kernel. Red Hat rated the issue Moderate, with a CVSS v3.1 score of 6.7.
Red Hat issued RHSA-2022:7683 for RHEL 8 kernel packages and RHSA-2022:7444 for RHEL 8 kernel-rt packages, remediating CVE-2022-1016. The flaw involves uninitialized stack registers in nft_do_chain() that can expose kernel pointers to a local low-privileged attacker.
Marian Rehak reported Red Hat's tracking bug for CVE-2022-1852, a medium-severity KVM x86 instruction-emulation flaw that can cause a NULL-pointer dereference and denial of service when an Intel-hosted guest executes an illegal instruction.
Marian Rehak reported that the Linux kernel ALSA subsystem's snd_pcm_hw_free function may unlock too early, creating a race condition that can lead to a use-after-free vulnerability. Fedora was tracked as affected.
Marian Rehak described CVE-2022-1016, a Netfilter/nf_tables flaw in which uninitialized stack registers in nft_do_chain() could leak kernel pointers.
Marian Rehak reported Red Hat's tracking bug for CVE-2022-24448, a low-severity Linux kernel NFS flaw where nfs_atomic_open() may return uninitialized file-descriptor data instead of ENOTDIR when O_DIRECTORY is used on a regular file.
CVE-2022-1184 was documented as a use-after-free in ext4 directory-index insertion, where crafted filesystem images and rename operations can trigger invalid reads in dx_insert_block(). The issue was reported reproducible on kernels 4.14, 5.16, and upstream 5.17.15, and Red Hat remediated it through RHEL 8, RHEL 9, and RHEL 8.6 EUS advisories.
Red Hat closed its Bugzilla record tracking CVE-2022-1016 after fixes had been made available for affected RHEL releases.
Upstream fixed CVE-2022-1016 with commit 4c905f6740a365464e91467aa50916555b28213d, which initializes nft_do_chain() registers. Fedora incorporated the correction in 5.16.18 stable kernel updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:0461** for Red Hat Enterprise Linux 9, updating the kernel to remediate 17 security vulnerabilities across networking, storage, graphics, Bluetooth, and virtualization components. The Important-rated advisory affects RHEL 9 and supported update-service variants on x86_64, ARM64, IBM Z, and IBM Power little-endian systems; administrators must reboot after applying the updated kernel. Among the fixes is **CVE-2023-3777**, a CVSS 7.8 use-after-free flaw in the Linux `nf_tables` netfilter component. A local attacker with `CAP_NET_ADMIN` in a user or network namespace could exploit improper bound-chain validation in `nf_tables_delrule()` to escalate privileges. Red Hat fixed affected RHEL 9 and selected RHEL 9 Extended Update Support kernel and real-time kernel packages, while RHEL 6, 7, and 8 are not affected; pending patching, organizations can prevent the netfilter module from loading and, where operationally feasible, disable user namespaces on non-containerized systems.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated RHEL 9 kernel and real-time kernel updates that remediate a broad set of Linux kernel vulnerabilities across networking, traffic control, XFRM, IPv6, USB, Wi-Fi, memory management, and virtualization components. The updates include `kernel-rt-5.14.0-284.11.1.rt14.296.el9_2` for x86_64 and corresponding standard kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 9 deployments, including EUS, ELS, SAP, AUS, and CodeReady variants. Notable fixes include races and memory-safety flaws tracked as `CVE-2022-3028`, `CVE-2022-3567`, `CVE-2022-3522`, `CVE-2022-4129`, `CVE-2022-43750`, `CVE-2022-47929`, `CVE-2023-0394`, and `CVE-2023-0590`. Impacts range from local denial of service and kernel-information disclosure to potential privilege escalation; `CVE-2022-3628` can be triggered through a malicious USB device against the `brcmfmac` Wi-Fi driver. Organizations should apply the applicable supported RHEL kernel errata, reboot systems to activate the new kernel, and, where patching `CVE-2022-3628` is not immediately possible, prevent loading the `brcmfmac` module.
Aug 26, 2026