Loading story…
Red Hat released Important RHEL 8 kernel updates addressing CVE-2023-1281, a use-after-free flaw in the Linux traffic-control tcindex filter. A local attacker could exploit a race involving updates to the imperfect hash area while packets traverse it, causing a freed tcf_ext object to be used by tcf_exts_exec() and potentially escalating privileges to root. Linux kernel versions from 4.14 through the upstream fix commit ee059170b1f7e94e55fa6cadee544e176a6e59c2 are affected.
The RHEL 8.2 AUS, TUS, SAP Solutions Update Services, and Telecommunications Update Service updates also remediate CVE-2023-0461, CVE-2023-1390, and CVE-2023-32233, including additional local use-after-free issues and a remotely triggerable TIPC denial of service. Organizations should install the applicable kernel packages—such as 4.18.0-193.109.1.el8_2 or the real-time 4.18.0-193.109.1.rt13.160.el8_2 release—and reboot; SAP Update Services deployments can use the supplied kpatch live-patch packages, which load automatically after installation on supported x86_64 and ppc64le systems.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:4256 for specified RHEL 8.4 service variants, providing kernel version 4.18.0-305.97.1.el8_4 for x86_64 and ppc64le offerings. The update fixes CVE-2023-1281 and CVE-2023-32233, among other bugs, and requires a system reboot to take effect.
Red Hat issued Important advisory RHSA-2023:4255 for kernel-rt packages on specified RHEL 8.4 real-time offerings, including Extended Life Cycle Long Life and Telecommunications/NFV Telecommunications Update Services. Kernel-rt version 4.18.0-305.97.1.rt7.172.el8_4 remediates CVE-2023-1281 and CVE-2023-32233; affected systems require a reboot after installation.
Red Hat issued Important advisory RHSA-2023:4130 for RHEL 8.6 Extended Update Support and related product channels, providing kernel build 4.18.0-372.64.1.el8_6. The update fixes CVE-2023-1281, CVE-2023-32233, CVE-2022-50396, and CVE-2022-50493; affected systems must reboot after installation.
Red Hat issued Important advisory RHSA-2023:4146, supplying kpatch live-patch packages for RHEL 8.2 Update Services for SAP Solutions on x86_64 and ppc64le. The live patch remediates CVE-2023-1281 and three additional kernel flaws, and is automatically loaded following RPM installation.
Red Hat issued Important advisory RHSA-2023:4126 for kernel-rt packages on RHEL for Real Time Telecommunications Update Service 8.2, including NFV deployments. The update, version 4.18.0-193.109.1.rt13.160.el8_2, fixes CVE-2023-1281 and three other kernel vulnerabilities; affected systems must reboot after installation.
Red Hat issued Important advisory RHSA-2023:4125, providing kernel version 4.18.0-193.109.1.el8_2 for affected RHEL 8.2 AUS, TUS, and SAP Update Services deployments. The update remediates CVE-2023-1281 along with CVE-2023-0461, CVE-2023-1390, and CVE-2023-32233; a reboot is required for the kernel fixes to take effect.
Red Hat issued Important advisory RHSA-2023:3852 for RHEL 8.1 Update Services for SAP Solutions on x86_64 and ppc64le. Kernel version 4.18.0-147.85.1.el8_1 fixes CVE-2023-1281 and CVE-2023-32233; affected systems must be rebooted after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important RHEL 8 kernel and `kpatch-patch` updates addressing **CVE-2023-0266**, an ALSA PCM control-element use-after-free vulnerability, and **CVE-2023-0461**, a use-after-free flaw in kernel network ULP handling for listening sockets. The fixes cover RHEL 8.4 EUS, AUS, TUS, Extended Life Cycle Long Life, SAP, and Real Time channels across x86_64, s390x, ppc64le, and aarch64, including kernel version `4.18.0-305.86.2.el8_4` and Real Time version `4.18.0-305.86.2.rt7.160.el8_4` packages. Red Hat also issued a live-patch update for RHEL 8.1 SAP Solutions systems that remediates CVE-2023-0461 and **CVE-2023-1390**, a remotely triggerable denial-of-service flaw in the TIPC module. CVE-2023-1390 can allow an attacker to send two small UDP packets to hosts configured with a UDP TIPC bearer, driving CPU use to 100% and making systems unresponsive. Administrators should install the applicable kernel updates and reboot systems where required; `kpatch-patch` packages apply supported fixes to running kernels without a conventional reboot.
Aug 26, 2026
Red Hat released Important Linux-kernel updates for **RHEL 8**, RHEL 9, and RHEL 8.1 Update Services for SAP Solutions to address **CVE-2022-32250**, a netfilter `nf_tables` use-after-free write that a local attacker could exploit to gain root privileges. The advisories also remediate **CVE-2022-1012**, in which predictable TCP source-port generation can allow a network observer to fingerprint hosts, infer traffic patterns, and estimate outbound connections. RHEL 9 updates additionally address **CVE-2022-1729**, a `perf_event_open` race condition permitting privilege escalation, and an IPsec ESP buffer-overflow flaw. Affected administrators should install the applicable updated kernel packages and reboot systems for the fixes to take effect; RHEL 8 version `4.18.0-372.19.1.el8_6` was provided for supported variants and x86_64, aarch64, ppc64le, and s390x architectures. The updates also include stability and performance corrections affecting dm-integrity, SR-IOV, SCTP, asymmetric TCP routing, and virtual-machine booting. Tracking for the netfilter flaw should use **CVE-2022-32250**: **CVE-2022-1966** was rejected as a duplicate. Red Hat notes RHEL 7 is not affected by CVE-2022-1012 because it uses a different TCP port-selection algorithm.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026