Loading story…
Red Hat released Important RHEL 8 kernel and kpatch-patch updates addressing CVE-2023-0266, an ALSA PCM control-element use-after-free vulnerability, and CVE-2023-0461, a use-after-free flaw in kernel network ULP handling for listening sockets. The fixes cover RHEL 8.4 EUS, AUS, TUS, Extended Life Cycle Long Life, SAP, and Real Time channels across x86_64, s390x, ppc64le, and aarch64, including kernel version 4.18.0-305.86.2.el8_4 and Real Time version 4.18.0-305.86.2.rt7.160.el8_4 packages.
Red Hat also issued a live-patch update for RHEL 8.1 SAP Solutions systems that remediates CVE-2023-0461 and CVE-2023-1390, a remotely triggerable denial-of-service flaw in the TIPC module. CVE-2023-1390 can allow an attacker to send two small UDP packets to hosts configured with a UDP TIPC bearer, driving CPU use to 100% and making systems unresponsive. Administrators should install the applicable kernel updates and reboot systems where required; kpatch-patch packages apply supported fixes to running kernels without a conventional reboot.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:3191 for RHEL 8.1 Update Services for SAP Solutions on x86_64 and ppc64le. Updated kpatch-patch packages remediated CVE-2023-0461 and the remotely triggerable TIPC denial-of-service vulnerability CVE-2023-1390.
Red Hat issued RHSA-2023:3190 for RHEL 8.1 Update Services for SAP Solutions on x86_64 and ppc64le. The kernel update, version 4.18.0-147.83.1.el8_1, remediated CVE-2023-0461 and CVE-2023-1390; affected systems must be rebooted after installation.
Red Hat issued RHSA-2023:1662, supplying updated kpatch-patch packages for supported RHEL 8.4 service streams. The live-patch module remediated CVE-2023-0266 and CVE-2023-0461 without a conventional kernel update process.
Red Hat issued RHSA-2023:1557, delivering kernel version 4.18.0-305.86.2.el8_4 for affected RHEL 8.4 support channels and architectures. It remediated CVE-2023-0266 and CVE-2023-0461, with a reboot required for the updated kernel to take effect.
Red Hat issued RHSA-2023:1556 for RHEL 8.4 Real Time offerings, providing kernel-rt 4.18.0-305.86.2.rt7.160.el8_4. The update fixed the ALSA PCM use-after-free CVE-2023-0266 and the net/ulp listening-socket use-after-free CVE-2023-0461; systems require a reboot after installation.
Red Hat Enterprise Linux 8 kernel-rt packages previously received a fix for CVE-2023-1390 through RHSA-2021:1739.
Red Hat Enterprise Linux 8 kernel packages previously received a fix for the remotely triggerable TIPC denial-of-service vulnerability CVE-2023-1390 through RHSA-2021:1578.
The Linux kernel fixed the TIPC tipc_link_xmit() flaw underlying CVE-2023-1390 in upstream kernel version 5.11, via commit b77413446408fdd256599daf00d5be72b5f3e7c6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2023:7417**, an Important security advisory supplying updated `kpatch-patch` live-kernel modules for Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions on x86_64 and IBM Power LE (`ppc64le`). The packages cover kernel streams `4.18.0-193.109.1`, `4.18.0-193.113.1`, and `4.18.0-193.116.1`, enabling affected systems to receive the fixes without a kernel reboot. The update remediates four Linux-kernel vulnerabilities: `CVE-2023-1829`, `CVE-2023-3609`, `CVE-2023-3776`, and `CVE-2023-4004`. `CVE-2023-1829` is a use-after-free and potential double-free issue in the traffic-control `tcindex` filter that may let a local attacker obtain root privileges; `CVE-2023-4004` is an Important-severity use-after-free in Netfilter nftables `nft_pipapo_remove()` that a low-privileged local user could trigger to crash a system or escalate privileges. Red Hat rated `CVE-2023-4004` CVSS 7.8 and noted that blocking the affected Netfilter module from loading can mitigate exposure where patching is not immediately possible.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released Important security updates for Red Hat Enterprise Linux 8 kernel and Real Time kernel deployments, remediating multiple vulnerabilities including **CVE-2023-2163**, an eBPF verifier-pruning flaw that can permit arbitrary kernel-memory reads and writes, privilege escalation, and container escape. Other fixes address a use-after-free in NVMe-over-TCP crypto cleanup (**CVE-2023-5178**), an AMD cross-process information disclosure issue (**CVE-2023-20593**), a DVB Common Interface driver use-after-free (**CVE-2022-45919**), network scheduler defects, and an SCTP NULL-pointer dereference. Affected organizations should deploy the applicable RHEL 8 kernel packages, including `kernel-rt-4.18.0-513.9.1.rt7.311.el8_9` for covered Real Time offerings and `kernel-4.18.0-372.80.1.el8_6` for RHEL 8.6 extended-support systems, then reboot to activate the fixes. Red Hat also delivered a kpatch update for RHEL 8.2 SAP Solutions that mitigates **CVE-2023-3812**, an oversized-packet flaw in the TUN driver; its live-patch module loads automatically and does not require a conventional reboot. Red Hat notes that exploiting CVE-2023-2163 on RHEL generally requires `CAP_SYS_ADMIN` or root because unprivileged eBPF is disabled by default.
Aug 26, 2026