Loading story…
Red Hat released Important-security-impact updates for CVE-2023-6546, a Linux kernel race condition in the GSM 07.10 (n_gsm) TTY multiplexer. Concurrent GSMIOC_SETCONF calls by a low-privileged local user on the same TTY file descriptor can trigger a use-after-free of struct gsm_dlci during GSM multiplexer restart, potentially enabling local privilege escalation. Red Hat assigns the flaw a CVSS 3.1 score of 7.0.
Affected RHEL 8 deployments should install the applicable kernel updates and reboot to activate them; RHEL Server 8.2 AUS on x86_64 received kernel version 4.18.0-193.136.1.el8_2 in RHSA-2024:4577. RHSA-2024:1612 also provides a kpatch-patch live-kernel module for RHEL 8 x86_64 and ppc64le, including RHEL 8.10 ELS, which loads after RPM installation to patch running kernels. Organizations unable to patch immediately can mitigate exposure by preventing the n_gsm kernel module from loading.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:4970, an Important-rated update for the kpatch-patch-4_18_0-305_120_1 live kernel patch module. It fixes CVE-2023-6546 for specified RHEL 8.4 SAP Solutions and Extended Life Cycle Long Life deployments on x86_64 and ppc64le without requiring an immediate reboot.
Red Hat issued RHSA-2024:4731, an Important-rated update providing kernel 4.18.0-305.134.1.el8_4 for RHEL 8.4 Extended Life Cycle Long Life, Advanced Update Support, Telecommunications Update Service, and SAP Solutions offerings. The update fixes CVE-2023-6546 and CVE-2024-21823; affected systems must be rebooted after installation.
Red Hat issued RHSA-2024:4729 for RHEL 8.4 Real Time ELC Long Life and telecommunications offerings on x86_64, providing kernel-rt 4.18.0-305.134.1.rt7.210.el8_4 to remediate CVE-2023-6546 and CVE-2024-21823. Systems must be rebooted after installation for the kernel fixes to take effect.
Red Hat issued RHSA-2024:4577 for Red Hat Enterprise Linux Server 8.2 Advanced Update Support on x86_64, fixing CVE-2023-6546 with kernel version 4.18.0-193.136.1.el8_2. Systems require a reboot after installation for the kernel fix to take effect.
Red Hat issued RHSA-2024:1614, supplying fixed Red Hat Enterprise Linux 8 kernel-rt packages for CVE-2023-6546.
RHSA-2024:1612 delivered an Important-rated kpatch-patch update for RHEL 8 on x86_64 and ppc64le, including RHEL 8.10 Extended Life Cycle releases. The live-patch module is loaded after RPM installation to apply the fix to a running kernel.
Red Hat issued RHSA-2024:1607, providing fixed Red Hat Enterprise Linux 8 kernel packages for CVE-2023-6546.
Red Hat issued RHSA-2024:0930 to fix CVE-2023-6546 in Red Hat Enterprise Linux 8.6 Extended Update Support kernel packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released an Important security update for Red Hat Enterprise Linux Server AUS 7.6 that fixes **CVE-2023-4623**, a CVSS 7.8 use-after-free flaw in the Linux kernel's `net/sched` Hierarchical Fair Service Curve (HFSC) traffic-control component. A local low-privileged attacker could exploit the dangling-pointer condition to escalate privileges when HFSC handles classes using link-sharing curves under a parent without one. RHSA-2024:1747 provides kernel build `3.10.0-957.112.1.el7` and associated packages for affected x86_64 RHEL 7.6 AUS systems; fixes were also issued for affected RHEL 7 and 8 kernel, real-time kernel, and kpatch packages. Administrators should install applicable prior errata and reboot to activate the updated kernel. Until patching is complete, Red Hat recommends blacklisting the `sch_hfsc` module to prevent its automatic loading.
Aug 26, 2026
Red Hat released kernel and live-patch updates for supported Red Hat Enterprise Linux (RHEL) 6, 7, and 8 lifecycle channels to remediate **CVE-2021-0920** and **CVE-2021-4083**. CVE-2021-0920 is a use-after-free flaw in the UNIX-domain socket garbage collector, `unix_gc()`, that can enable local privilege escalation; CVE-2021-4083 is a related file-descriptor lifetime race in `fget()` that can leave garbage-collected socket objects reachable and trigger a read-after-free condition. The fixes were distributed through standard kernel packages and `kpatch-patch` live-kernel modules for affected Extended Update Support, SAP, telecommunications, virtualization, and Real Time offerings. Several advisories also bundled fixes for other privilege-escalation, use-after-free, information-disclosure, and denial-of-service flaws, including CVE-2021-4028, CVE-2022-0330, CVE-2022-0492, and CVE-2022-22942. Administrators should apply the applicable kernel update and reboot systems where required; deployments using the supplied live-patch modules can receive covered fixes without a conventional reboot.
Aug 27, 2026