Loading story…
Red Hat released RHSA-2023:7417, an Important security advisory supplying updated kpatch-patch live-kernel modules for Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions on x86_64 and IBM Power LE (ppc64le). The packages cover kernel streams 4.18.0-193.109.1, 4.18.0-193.113.1, and 4.18.0-193.116.1, enabling affected systems to receive the fixes without a kernel reboot.
The update remediates four Linux-kernel vulnerabilities: CVE-2023-1829, CVE-2023-3609, CVE-2023-3776, and CVE-2023-4004. CVE-2023-1829 is a use-after-free and potential double-free issue in the traffic-control tcindex filter that may let a local attacker obtain root privileges; CVE-2023-4004 is an Important-severity use-after-free in Netfilter nftables nft_pipapo_remove() that a low-privileged local user could trigger to crash a system or escalate privileges. Red Hat rated CVE-2023-4004 CVSS 7.8 and noted that blocking the affected Netfilter module from loading can mitigate exposure where patching is not immediately possible.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2023:5221, RHSA-2023:5244, and RHSA-2023:5255 for RHEL 8 kpatch-patch, kernel, and kernel-rt packages, respectively, remediating CVE-2023-4004.
Red Hat released RHSA-2023:4961 and RHSA-2023:4962 for RHEL 8.4 Telecommunications Update Service, addressing CVE-2023-4004. These advisories also addressed the Linux tcindex use-after-free flaw CVE-2023-1829 for applicable RHEL 8.4 update-service channels.
Red Hat published the CVE-2023-4004 record for an Important-severity Linux kernel Netfilter use-after-free vulnerability in nft_pipapo_remove(). A low-privileged local user could trigger a crash or potentially escalate privileges by removing an element without NFT_SET_EXT_KEY_END.
Red Hat published RHSA-2023:7417, providing kpatch-patch live kernel patch modules for RHEL 8.2 Update Services for SAP Solutions. The update remediated CVE-2023-1829 and CVE-2023-4004, along with CVE-2023-3609 and CVE-2023-3776.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kpatch/live-patch updates for supported Red Hat Enterprise Linux 8 and 9 systems, including SAP, EUS, AUS, ELC, telecommunications, and mission-critical variants. The advisories remediate five Linux kernel vulnerabilities in the HFSC network scheduler and DesignWare I2C driver, including the HFSC use-after-free issue tracked as `CVE-2025-37890`, reentrant enqueue behavior, queue-length-accounting and empty-child-notification defects, and `CVE-2025-38380`. `CVE-2025-38380` stems from incomplete initialization in the AMD-specific `amd_i2c_dw_xfer_quirk()` routine: `msg_write_idx` was not initialized before `i2c_dw_xfer_init()` ran, potentially causing an out-of-bounds access to I2C message data. Updates cover RHEL 8 kernel `4.18.0-553.16.1.el8_10` and RHEL 9 kernel `5.14.0-570.17.1.el9_6`, plus specified RHEL 9 SAP kernel builds, on x86_64 and ppc64le. Organizations should deploy the applicable kpatch packages and reboot affected hosts for the fixes to take effect.
Aug 26, 2026
Red Hat released **Important** kernel security updates and live patches for multiple Red Hat Enterprise Linux versions to remediate several Linux kernel vulnerabilities, including `CVE-2026-43499`, `CVE-2026-46116`, and `CVE-2026-46227`. The updates span standard kernel packages for **RHEL 7 ELS** and **RHEL 9**, as well as **kpatch** live-patch modules for **RHEL 9** and **RHEL 10**, allowing some systems to receive fixes without a reboot. The advisories also bundle additional kernel issues such as `CVE-2026-45984`, `CVE-2026-53166`, `CVE-2026-64531`, and `CVE-2026-31684`, affecting a broad set of x86_64, ppc64le, s390x, and aarch64 product variants, including SAP, EUS, and ELS offerings. The patched flaws include an **rtmutex** bug in `remove_waiter()` that could manipulate the wrong task state during futex proxy locking, an **xfrm** state-deletion bug that triggered slab use-after-free and out-of-bounds writes under repeated list removal, and an **SCTP** `SCTP_SENDALL` iterator flaw that could leave a stale association pointer after the socket lock was dropped, creating use-after-free or type-confusion conditions. Red Hat said fixes were propagated across numerous RHEL 8, 9, and 10 streams and support channels, with standard kernel packages requiring a reboot and `kpatch` updates available for selected RHEL 9 and RHEL 10 kernels.
Aug 25, 2026
Red Hat released **RHSA-2023:7418**, an Important-security update for the RHEL 9.2 `kpatch-patch` live-patching module, remediating eight Linux kernel vulnerabilities across supported x86_64 and ppc64le subscription streams. The RPM automatically loads the live patch after installation, updating vulnerable running kernel code without requiring a conventional reboot-based kernel replacement. The fixes include **CVE-2023-3812** (CVSS 7.8), an out-of-bounds write in the TUN/TAP driver that a low-privileged local user can trigger with an oversized IPv6 packet when NAPI fragments are enabled, potentially causing a crash or privilege escalation. They also address **CVE-2023-5178** (CVSS 8.8), a use-after-free and double-free flaw in the NVMe/TCP target subsystem that can permit remote code execution or local privilege escalation where NVMe over TCP is enabled, alongside net/sched, netfilter, and other kernel memory-safety defects. Organizations unable to promptly patch CVE-2023-3812 can reduce exposure by preventing the `tun` kernel module from loading; Red Hat identified no standalone mitigation for CVE-2023-5178.
Aug 26, 2026