Loading story…
Red Hat issued fixes for CVE-2022-48754, a use-after-free flaw in the Linux kernel's phylib networking subsystem. The vulnerability occurs in phy_detach() because phy_device_reset() was called after put_device(), which may already have released the PHY device. The upstream correction moves the reset operation before put_device().
The flaw was introduced in Linux 4.16 and corrected in upstream stable releases including 4.19.228, 5.4.176, 5.10.96, 5.15.19, 5.16.5, and 5.17. Red Hat delivered fixes for RHEL 8 kernel, kernel-rt, and RHEL 8.8 Extended Update Support through advisories including RHSA-2024:6206, RHSA-2024:7000, and RHSA-2024:7001; Red Hat listed RHEL 9 kernel and kernel-rt as affected at publication. Red Hat rated the issue Low severity with CVSS 5.6, while the CVE record carried a 7.8 score.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:7000 for the RHEL 8 kernel and RHSA-2024:7001 for the RHEL 8 kernel-rt, addressing CVE-2022-48754.
Red Hat released RHSA-2024:6206, fixing the phylib use-after-free vulnerability for the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Mauro Matteo Cascella reported CVE-2024-40901, involving test_bit() and set_bit() operations on unallocated memory in the Linux kernel SCSI mpt3sas driver.
A deadlock vulnerability involving extended-attribute inode creation under an external xattr-block buffer lock was reported in Linux ext4. Corrupted filesystems, including a quota file using an xattr block as data, can trigger the flawed lock ordering.
The Linux kernel CVE team assigned CVE-2022-48754 to a phylib use-after-free flaw in phy_detach(), where phy_device_reset() could run after put_device() had released the PHY device. The flaw was introduced in Linux kernel 4.16; the remediation moves the reset call before put_device().
Red Hat addressed CVE-2024-40901 in RHEL 8 through RHSA-2024:7000 and RHSA-2024:7001, RHEL 9 through RHSA-2024:9315, and RHEL 9.4 Extended Update Support through RHSA-2024:9546.
Upstream Linux kernel releases fixed the mpt3sas driver's bit operations on unallocated memory, including versions 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, 6.6.35, 6.9.6, and 6.10-rc4.
Red Hat addressed the ext4 vulnerability for RHEL 8 through RHSA-2024:7000 and RHSA-2024:7001, and for RHEL 9 through RHSA-2024:8617.
The ext4 remediation moved EA-inode allocation out of ext4_xattr_set_entry() and into its callers. The issue is listed as fixed in Linux kernel 6.9.7 and 6.10-rc1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important kernel updates to fix **CVE-2026-74581**, a use-after-free flaw in the Linux IPv6 FIB rule lookup path. In `fib6_rule_suppress`, a stale `res->rt6` pointer can be returned after its associated `rt6_info` route object has been freed and later released again, creating a potential kernel crash or privilege-escalation condition. Exploitation requires the ability to configure IPv6 routing or FIB rules; the issue is classified as **CWE-416**. The remediation is included in RHEL 9 kernel updates, including RHSA-2026:59723 and applicable kernel-rt updates, and in selected RHEL 8.4 AUS and Extended Life Cycle/Long-Life support channels through advisories including RHSA-2026:59994 and RHSA-2026:60485. Administrators should update affected kernel packages and reboot to activate the fix. Blacklisting IPv6 modules does not mitigate affected kernels with IPv6 built in; organizations that do not require IPv6 can consider disabling it through kernel command-line configuration. Related Oracle Linux and AlmaLinux 9 kernel updates also incorporate the broader RHEL 9 kernel fixes; available notices reported no known public exploits.
Sep 1, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026