Loading story…
Red Hat released RHSA-2024:4098 to remediate CVE-2023-2002, a moderate-severity Linux kernel flaw in the Bluetooth HCI socket implementation. The missing capability check in net/bluetooth/hci_sock.c can allow a low-privileged attacker with adjacent Bluetooth-network access to issue unauthorized Bluetooth management commands, potentially affecting the confidentiality, integrity, and availability of Bluetooth communications.
The advisory provides kernel version 3.10.0-957.114.1.el7 for Red Hat Enterprise Linux Server AUS 7.6 on x86_64. Red Hat rates the issue CVSS 3.1 6.8 and classifies it as CWE-250, Execution with Unnecessary Privileges; fixes are also available for affected RHEL 7 and 8 kernel and kernel-rt packages. Administrators should apply applicable prior errata and reboot systems after installing the update, as no generally suitable mitigation is available.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2024:2003 for the RHEL 7 kernel-rt and RHSA-2024:2004 for the standard RHEL 7 kernel, fixing CVE-2023-2002.
Red Hat remediated CVE-2023-2002 in the Red Hat Enterprise Linux 7.7 Advanced Update Support kernel through RHSA-2024:1746.
Red Hat issued fixes for CVE-2023-2002 in Red Hat Enterprise Linux 8 kernel-rt through RHSA-2023:5255 and in the standard kernel through RHSA-2023:5244.
Red Hat released RHSA-2023:4962 for the Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Telecommunications Update Service kernel, and RHSA-2023:4961 for the Telecommunications Update Service kernel-rt package, addressing CVE-2023-2002.
Red Hat released Moderate-severity advisory RHSA-2024:4098 for Red Hat Enterprise Linux Server AUS 7.6 on x86_64, providing kernel version 3.10.0-957.114.1.el7 to fix CVE-2023-2002. The company stated that systems must be rebooted after installation for the update to take effect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel updates for **RHEL 7** and **RHEL for Real Time 7** that remediate nine vulnerabilities, including use-after-free, double-free, out-of-bounds-write, information-disclosure, and local privilege-escalation flaws. The fixes include **CVE-2021-3752**, a Bluetooth `lock_sock_nested()` use-after-free condition that a local user could potentially trigger to gain partial privilege escalation. Updated packages are `kernel-3.10.0-1160.59.1.el7` for RHEL 7 and `kernel-rt-3.10.0-1160.59.1.rt56.1200.el7` for the real-time variant, covering supported x86_64, IBM Z, IBM Power, and related RHEL 7 deployments. Administrators should install the updates published in **RHSA-2022:0620** and **RHSA-2022:0622** and reboot affected hosts, as the kernel fixes do not take effect until restart. Red Hat also updated the `3scale-amp2/system-rhel7` container image through **RHBA-2022:0679** to incorporate the RHEL 7 security fixes; 3scale API Management users should upgrade that image and rebuild dependent container images.
Aug 26, 2026
Red Hat released kernel and real-time kernel updates for **CVE-2023-40283**, a CVSS 7.8 use-after-free flaw in the Linux Bluetooth L2CAP socket-release routine, `l2cap_sock_release`. Improper handling of child sockets can allow a local low-privileged user to trigger the vulnerability, potentially compromising confidentiality, integrity, and availability. The upstream fix is commit `1728137b33c00d5a2b5110ed7aafb42e7c32e4a1`, included in Linux kernel 6.4.10; Red Hat reported no qualifying mitigation beyond updating affected systems. Affected Red Hat Enterprise Linux 8.4 support channels received kernel `4.18.0-305.130.1.el8_4` under RHSA-2024:2582, while relevant RHEL 8.4 real-time deployments received kernel-rt `4.18.0-305.130.1.rt7.206.el8_4` through RHSA-2024:2585. RHSA-2024:10772 also includes the remediation in kernel `5.14.0-284.95.1.el9_2` for RHEL 9.2 update channels. Administrators should install the applicable updated kernel packages and reboot to activate the fixes.
Aug 26, 2026
Red Hat released kernel and real-time kernel updates for supported **Red Hat Enterprise Linux (RHEL) 8 and 9** systems to remediate **CVE-2022-3619**, a Bluetooth L2CAP memory-leak flaw in `l2cap_recv_acldata` within `net/bluetooth/l2cap_core.c`. An adjacent attacker could send malicious Bluetooth packets without privileges or user interaction and potentially exhaust memory or crash an affected host. Red Hat rated the issue moderate severity with a CVSS v3.1 score of 4.3 and classified it as CWE-401. The fixes were included in RHEL 8 kernel version `4.18.0-477.10.1.el8_8` under RHSA-2023:2951 and the real-time kernel version `4.18.0-477.10.1.rt7.274.el8_8` under RHSA-2023:2736, alongside numerous other kernel security corrections affecting virtualization, networking, wireless, USB, and memory safety. Organizations should install the applicable kernel packages and reboot systems; where patching cannot occur promptly, disabling Bluetooth through module blocklisting, hardware controls, or BIOS settings reduces exposure.
Aug 26, 2026