Loading story…
Red Hat released fixes for CVE-2023-28466, a moderate-severity race condition in the Linux kernel TLS subsystem's do_tls_getsockopt function. The flaw can trigger a use-after-free condition or NULL-pointer dereference; a local attacker with low privileges could affect system confidentiality, integrity, and availability. Red Hat rates the vulnerability CVSS 7.0.
The remediation includes RHEL 8 kernel packages under RHSA-2023:3847, including kernel-4.18.0-477.15.1.el8_8 for supported x86_64, s390x, ppc64le, and aarch64 variants, with fixes also available for affected RHEL 9 kernels. Organizations should install the applicable updates and reboot systems; where patching cannot occur immediately, Red Hat recommends preventing the TLS kernel module from loading at boot.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2023:3847, a Moderate-severity RHEL 8 kernel security update fixing the TLS do_tls_getsockopt race condition behind CVE-2023-28466. The update supplied kernel version 4.18.0-477.15.1.el8_8 packages and required affected systems to reboot after installation.
Red Hat issued RHSA-2023:3819, providing a fix for CVE-2023-28466 in the Red Hat Enterprise Linux 8 kernel-rt variant.
Red Hat released RHSA-2023:3723 to fix CVE-2023-28466 in the Red Hat Enterprise Linux 9 kernel.
Red Hat released RHSA-2023:3708 to remediate CVE-2023-28466 in the Red Hat Enterprise Linux 9 kernel-rt variant.
Red Hat released RHSA-2023:4814 to remediate CVE-2023-28466 in the Red Hat Enterprise Linux 9.0 Extended Update Support kernel-rt variant.
Red Hat released RHSA-2023:4801 to remediate CVE-2023-28466 in the Red Hat Enterprise Linux 9.0 Extended Update Support kernel.
Red Hat released RHSA-2023:4789, fixing CVE-2023-28466 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released updated Linux kernel and real-time kernel packages for supported RHEL 8 and RHEL 9 service streams to remediate **CVE-2025-38464** and **CVE-2025-38085**. CVE-2025-38464 is a use-after-free in TIPC topology-server connection teardown: a race between `tipc_topsrv_stop()` and receive-work handling can release a connection’s final reference before `tipc_conn_close()` completes. CVE-2025-38085 affects hugetlb memory management, where a race between `huge_pmd_unshare()` and GUP-fast can cause a page-table walk to traverse another process’s page tables; upstream reported no immediate kernel-memory-corruption path. The fixes retain TIPC connection references through close processing and synchronize removal of shared huge-page tables with an IPI. Affected offerings include RHEL 8.4, 8.8, 8.10 and RHEL 9.2 variants, including SAP, telecommunications, AUS, EUS, ELC, and Real Time deployments; examples include kernel `4.18.0-477.108.1.el8_8`, `4.18.0-305.172.1.el8_4`, and `5.14.0-284.136.1.el9_2`. Administrators should apply the applicable Red Hat security updates and reboot systems to load the patched kernel.
Aug 26, 2026
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026