Loading story…
Red Hat released updated Linux kernel and kernel-rt packages for affected RHEL 7, 8, and 9 streams to address Intel processor MMIO stale-data vulnerabilities: CVE-2022-21123 (SBDR), CVE-2022-21125 (SBDS), and CVE-2022-21166 (DRPW). The flaws stem from incomplete cleanup of shared buffers, fill buffers, and special-register write resources, potentially exposing stale processor data. Updates cover standard RHEL releases as well as EUS, AUS, TUS, SAP, telecommunications, and mission-critical offerings across supported architectures.
Several advisories also remediate CVE-2022-2588, a cls_route use-after-free that could enable local privilege escalation, alongside other kernel flaws; separate RHEL updates address CVE-2022-1158 in KVM and CVE-2022-2639, an Open vSwitch out-of-bounds write. Organizations should install the applicable updated kernel packages, reboot systems to activate the fixes, and update or rebuild affected Red Hat OpenStack Platform 17.0 container images where applicable.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHBA-2022:9021 to update Red Hat OpenStack Platform 17.0 container images with backported patches from RHSA-2022:8973. The images included fixes for CVE-2022-1158, CVE-2022-2639, and the SBDR, SBDS, and DRPW CPU vulnerabilities, among other issues.
Red Hat issued RHSA-2022:8973 for RHEL 9.0 Extended Update Support, delivering kernel 5.14.0-70.36.1.el9_0. The update remediated CVE-2022-1158, CVE-2022-2639, CPU cleanup flaws CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166, plus watch queue, NFSD, RetBleed, and other kernel vulnerabilities.
Red Hat released RHSA-2022:7444 and RHSA-2022:7683 for RHEL 8 kernel-rt and kernel packages, respectively, fixing CVE-2022-1158. The KVM flaw could let a low-privileged local host user write outside the userspace memory region and corrupt kernel memory; these advisories also addressed CVE-2022-2639.
Red Hat issued RHSA-2022:7280 for RHEL 8.2 Telecommunications Update Service Real Time and Real Time for NFV x86_64 systems. The kernel-rt update fixed CVE-2022-2588 and the SBDR, SBDS, and DRPW CPU data-cleanup flaws (CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166).
Red Hat published RHSA-2022:7279 for specified RHEL 8.2 AUS, TUS, and SAP offerings. Kernel version 4.18.0-193.93.1.el8_2 remediated CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166, as well as CVE-2022-2588.
Red Hat issued RHSA-2022:6983 and RHSA-2022:6991 for RHEL 8.4 Extended Update Support. The kernel and real-time kernel updates remediated CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166 alongside other Linux kernel vulnerabilities.
Red Hat published RHSA-2022:6872 for RHEL 8.1 Update Services for SAP Solutions, updating the kernel to address CVE-2022-21123 (SBDR), CVE-2022-21125 (SBDS), and CVE-2022-21166 (DRPW), among other issues.
Red Hat released RHSA-2022:5937 and RHSA-2022:5939 for RHEL 7 kernel and kernel-rt packages, respectively, fixing CVE-2022-21123, an Intel shared-buffer incomplete-cleanup information-disclosure flaw.
Red Hat closed the Bugzilla record for CVE-2022-2639, the Linux kernel Open vSwitch out-of-bounds write vulnerability in reserve_sfa_size().
Red Hat's Product Security DevOps Team closed the Bugzilla records for CVE-2022-21123, CVE-2022-21125, and CVE-2022-21166, directing customers to the respective CVE pages for future product-specific updates.
Red Hat released RHEL 8.2 AUS, TUS, and SAP package updates through RHSA-2022:8940, RHSA-2022:8941, and RHSA-2022:8989. The updates fixed CVE-2022-1158 and remediated CVE-2022-2639, an Open vSwitch reserve_sfa_size() integer-underflow issue that could cause an out-of-bounds write.
Red Hat released RHSA-2022:8673, RHSA-2022:8685, and RHSA-2022:8686 for RHEL 8.4 Extended Update Support, providing kernel-rt, kernel, and kpatch-patch fixes for CVE-2022-1158.
Red Hat issued RHSA-2022:6437 for the RHEL 8 kernel-rt package and RHSA-2022:6460 for the RHEL 8 kernel package, fixing CVE-2022-21166 (DRPW), an Intel incomplete-cleanup information-disclosure vulnerability.
Intel documented the Processor MMIO Stale Data vulnerability class, comprising DRPW (CVE-2022-21166), SBDR (CVE-2022-21123), SBDS (CVE-2022-21125), and the SRBDS Update (CVE-2022-21127). Intel recommended applicable microcode or firmware updates and OS/VMM mitigations including VERW-based fill-buffer clearing and restricting untrusted MMIO access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceintel.com
Open sourcecve.mitre.org
Open sourcefirst.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, RHEL 9, and supported extended-life, update-service, SAP, and Real Time variants. The advisories address **Native Branch History Injection** (`CVE-2024-2201`), a Spectre-v2-related speculative-execution flaw on recent Intel CPUs that can bypass FineIBT mitigations and leak kernel memory, alongside vulnerabilities in networking, storage, filesystems, device drivers, wireless code, and CPU handling. Included fixes cover an AF_UNIX garbage-collector race (`CVE-2024-26923`), improper LLSEC key-resource release in `mac802154` (`CVE-2024-26961`), an MPTCP uninitialized-state issue (`CVE-2024-40931`), USB CDC-WDM log-flooding that can trigger CPU soft lockups (`CVE-2024-40904`), and an out-of-bounds `tty` imageblit access (`CVE-2021-47383`). Organizations should install the applicable updated kernel packages—including RHEL 8.6 builds `4.18.0-372.113.1.el8_6`, `4.18.0-372.121.1.el8_6`, or `4.18.0-372.124.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026