Loading story…
CVE-2023-2235 is an important-severity use-after-free flaw in the Linux kernel Performance Events subsystem. A low-privileged local user can concurrently invoke perf_group_detach() and remove_on_exec, causing unsafe event-group handling that can crash the system or potentially permit local privilege escalation. Red Hat rated the issue CVSS 7.8 with high confidentiality, integrity, and availability impact.
The upstream fix corrects perf_group_detach() so sibling events are re-added to the group red-black tree based on each sibling's PERF_ATTACH_CONTEXT state, rather than the detached event's group-node state. Red Hat shipped kernel fixes for affected RHEL 8 and RHEL 9 variants and related products between June and October 2023; RHEL 8.4 and RHEL 6 are not affected.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed CVE-2023-2235 in the RHEL 8 kernel and kernel-rt components through RHSA-2023:4517 and RHSA-2023:4541.
Red Hat released CVE-2023-2235 fixes for the RHEL 9.0 Extended Update Support kernel and kernel-rt components through RHSA-2023:4137 and RHSA-2023:4138.
Red Hat issued fixes for RHEL 9 kernel, kernel-rt, and kpatch-patch components in RHSA-2023:3723, RHSA-2023:3708, and RHSA-2023:3705.
Red Hat published the record for CVE-2023-2235, an important-severity use-after-free flaw in the Linux kernel Performance Events subsystem that could allow a low-privileged local user to crash a system or potentially escalate privileges.
Peter Zijlstra committed Budimir Markovic's patch for incorrect event-group handling in perf_group_detach(). The change prevents events removed by list_del_event() through remove_on_exec from being re-added to a group's red-black tree.
Red Hat released RHSA-2023:5627 to fix the affected kernel component for RHEL 8.6 Extended Update Support and Red Hat Virtualization 4 for RHEL 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-5717** is a moderate-severity out-of-bounds write flaw in the Linux kernel Performance Events (`perf_events`) subsystem. A low-privileged local attacker could trigger it by reading an inherited performance-event group whose `sibling_list` is smaller than its child group's list, causing writes outside the intended buffer. Successful exploitation could crash the system, execute code, or elevate privileges; the vulnerability carries a CVSS v3.1 score of 7.8. The upstream fix adds a `group_generation` counter to track performance-event group membership changes, propagates that state to inherited groups, and rejects reads with `-ECHILD` when parent and child generation values or sibling counts differ. Red Hat released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems and Red Hat Virtualization 4 for RHEL 8. Red Hat noted that the default `kernel.perf_event_paranoid=2` setting prevents the vulnerable code path from being triggered.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
**CVE-2023-3390** is an important-severity use-after-free flaw in the Linux kernel's Netfilter/nftables subsystem. Improper handling of named and anonymous sets in batch requests can allow a local attacker with `CAP_NET_ADMIN` to read and write arbitrary kernel memory, potentially causing denial of service or escalating privileges. Red Hat rates the vulnerability **CVSS 7.8** (`AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`). Unprivileged user namespaces can enable local unprivileged RHEL users to obtain the capability needed for exploitation. Red Hat released fixes for affected RHEL 8 `kernel`, `kernel-rt`, and `kpatch` packages, with updates issued from September 2023 through March 2024. OpenShift control-plane hosts contain the affected component, but Red Hat assesses container exploitation risk as low because OpenShift namespace controls prevent containers from obtaining the required capability.
Aug 26, 2026