Loading story…
Red Hat released Important-rated kernel and real-time kernel updates for affected RHEL 8.2 Advanced Update Support, Telecommunications Update Service, SAP Solutions, Real Time, and Real Time for NFV deployments. The updates remediate seven Linux kernel flaws, including CVE-2023-4459, a NULL-pointer dereference in the vmxnet3 network driver that can allow a local user to crash a system through an MTU-change error path, and CVE-2023-7192, a Netfilter connection-tracking reference-count leak that a local attacker with CAP_NET_ADMIN can exploit to cause denial of service.
The advisories also address use-after-free, stack-corruption, divide-error, oversized-packet handling, and membarrier resource-exhaustion conditions. Organizations using the affected non-real-time kernel should deploy build 4.18.0-193.133.1.el8_2; affected real-time environments should install the applicable updated kernel-rt packages. Systems must be rebooted after installation for the kernel fixes to take effect.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated advisory RHSA-2024:2008 for RHEL 8.2 Real Time and Real Time for NFV Telecommunications Update Service systems. Kernel-rt version 4.18.0-193.133.1.rt13.184.el8_2 remediated seven flaws, including CVE-2023-4459 and CVE-2023-7192, and required a reboot.
Red Hat issued Important-rated advisory RHSA-2024:2006 for RHEL 8.2 AUS, TUS, and SAP Solutions deployments. Kernel build 4.18.0-193.133.1.el8_2 fixed seven vulnerabilities, including CVE-2023-4459 and CVE-2023-7192; affected systems require a reboot.
Red Hat published an Important kpatch-patch update for RHEL 9.0 Extended Update Support and SAP Solutions systems. The live patch remediated five networking and netfilter vulnerabilities, including CVE-2023-3776, CVE-2023-3812, CVE-2023-4004, CVE-2023-4147, and CVE-2023-42753.
Red Hat issued Important-rated RHSA-2023:7431 for RHEL 8.2 Real Time Telecommunications Update Service and Real Time for NFV Telecommunications Update Service systems. Kernel-rt version 4.18.0-193.119.1.rt13.170.el8_2 fixed CVE-2023-1829, CVE-2023-3609, CVE-2023-3776, and CVE-2023-4004; affected systems require a reboot.
Red Hat issued an Important security and bug-fix update for RHEL 8 kernel-rt packages, including Real Time and Real Time for NFV offerings. It addressed multiple kernel vulnerabilities, including Zenbleed and flaws in Bluetooth, nftables, netfilter, networking schedulers, ipvlan, and cls_flower.
Red Hat issued an Important-rated kernel-rt security and bug-fix update for RHEL 8.4 Advanced Mission Critical, Telecommunications, and SAP update-service offerings. The update remediated eight flaws across traffic control, ipvlan, nftables/netfilter, cls_flower, Bluetooth, and XFS, and required a reboot.
Red Hat issued Important-rated RHSA-2023:4817 for RHEL 8.2 Real Time and Real Time for NFV Telecommunications Update Service deployments. Kernel-rt version 4.18.0-193.113.1.rt13.164.el8_2 fixed CVE-2023-2124, CVE-2023-35788, and CVE-2023-3090; affected systems require a reboot.
CVE-2024-26586 could corrupt the kernel stack and panic systems using mlxsw Spectrum-2 or newer switching ASICs when an ACL group exceeded the 16-ACL PAGT-register capacity. The fix caps ACL-group size at the lower of firmware-reported and hardware-register limits and adds a regression test; fixes were backported to stable kernels and multiple Red Hat Enterprise Linux update streams.
The Linux kernel fixed CVE-2023-7192 in commit ac4893980bbe79ce383daf9a0885666a30fe4c83. A local attacker with CAP_NET_ADMIN could trigger reference-count overflows in ctnetlink_create_conntrack(), resulting in denial of service.
The Linux kernel fixed CVE-2023-4459 in commit edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd. The flaw could allow a local unprivileged attacker to cause denial of service when vmxnet3 receive-queue cleanup dereferences a NULL receive-ring base pointer after DMA allocation failure.
Linux fixed CVE-2023-1829 with commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. The tcindex_delete flaw failed to deactivate perfect-hash filters before deletion, enabling a double free that a local attacker could use to escalate privileges to root.
Fedora fixed CVE-2023-4004 in its Linux kernel 6.4.7 stable update. The Netfilter nftables pipapo-set flaw is a use-after-free in nft_pipapo_remove() when an element is inserted without NFT_SET_EXT_KEY_END.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important security updates for Real Time Linux Kernel packages in Red Hat Enterprise Linux (RHEL) 8.4 and RHEL 9.0 support channels. The updates address multiple kernel memory-safety and logic flaws, including use-after-free vulnerability **CVE-2022-3545** in the Netronome NFP driver, NULL-pointer dereference **CVE-2023-2166** in the CAN protocol implementation, and an out-of-bounds read/possible privilege-escalation issue, **CVE-2023-2176**, in the RDMA Connection Manager. They also remediate **CVE-2022-38096**, a vmwgfx driver NULL-pointer dereference that a local user with access to DRM device nodes could use to crash a host. Affected deployments include RHEL 9.0 Extended Update Support for SAP Solutions using `kernel-rt-5.14.0-70.85.1.rt21.156.el9_0`, and RHEL 8.4 Real Time variants using `kernel-rt-4.18.0-305.125.1.rt7.201.el8_4`, including long-life, telecommunications, and NFV support offerings. The advisories collectively fix additional use-after-free, reference-counting, memory-boundary, networking, netfilter, and local privilege-escalation defects; organizations should apply the applicable kernel-rt update and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released RHEL 8 kernel security updates through **RHSA-2022:1975** for Real Time Linux and **RHSA-2022:1988** for related RHEL 8 packages, remediating numerous kernel vulnerabilities affecting memory safety, privilege boundaries, networking, USB, eBPF, denial of service, information disclosure, and speculative execution. Notable fixes include `CVE-2021-3612`, an out-of-bounds write in joystick ioctl handling; `CVE-2021-3759`, which could bypass memory-cgroup accounting and crash a host; `CVE-2021-3743`, an out-of-bounds read in the QRTR protocol handler; and `CVE-2021-3773`, involving Netfilter behavior that could affect certain OpenVPN NAT deployments. Affected Real Time, NFV, Telecommunications Update Service, and Extended Life Cycle RHEL 8 x86_64 systems should update to `kernel-rt-4.18.0-372.9.1.rt7.166.el8` or a later applicable package and reboot. Red Hat also refreshed Quarkus 2.7, CodeReady Workspaces 2.0, and `rhpam-kogito-builder-rhel8` container images that incorporate the kernel fixes; organizations using those images should pull the updated versions, update Dockerfile or build-script references, and rebuild dependent images.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026