Loading story…
Red Hat released Important-rated kernel and real-time kernel updates for selected Red Hat Enterprise Linux 8.4 extended-support, SAP, telecommunications, and NFV offerings. The updates, including kernel-4.18.0-305.138.1.el8_4 and kernel-rt-4.18.0-305.138.1.rt7.214.el8_4, remediate six vulnerabilities spanning netfilter/nf_tables, route management, the Ionic network driver, and NFS server processing.
Three addressed NFS server defects—CVE-2022-48827, CVE-2022-48828, and CVE-2022-48829—involve unsafe handling of client-controlled 64-bit offsets and file sizes. The fixes prevent integer underflow and invalid size handling in NFSv3/v4 attribute operations, ensure oversized NFSv3 requests return NFS3ERR_FBIG, and make reads near the maximum file offset return a short EOF-marked response rather than trigger client retry loops. Administrators should install the applicable advisory packages and reboot affected systems to activate the updated kernel.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued the Important-rated RHSA-2024:5282 advisory for RHEL 8.4 real-time and telecommunications offerings on x86_64. The fixed kernel-rt build 4.18.0-305.138.1.rt7.214.el8_4 remediates the same netfilter, route-management, Ionic-driver, and NFSD vulnerabilities, including CVE-2022-48827 through CVE-2022-48829.
Red Hat issued the Important-rated RHSA-2024:5266 advisory for supported RHEL 8.4 service variants. The kernel update 4.18.0-305.138.1.el8_4 fixes CVE-2024-36005, CVE-2024-36971, CVE-2024-39502, and NFSD flaws CVE-2022-48827, CVE-2022-48828, and CVE-2022-48829; affected systems require a reboot after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate- and Important-severity Linux kernel security updates across RHEL 8 and RHEL 9 support channels, including Real Time, NFV, SAP Solutions, Extended Life Cycle, Extended Update Support, and Application Update Services offerings. The advisories address vulnerabilities in NFS server processing, SMB/CIFS rename handling, memory-failure recovery, TCP Fast Open, Wi-Fi, Bluetooth, USB audio, EFI variables, SCTP, IPv6 routing, ext4, and network drivers. Updated packages include `4.18.0-553.87.1.el8_10` for RHEL 8.10, `4.18.0-477.120.1.el8_8` for selected RHEL 8.8 channels, `5.14.0-284.148.1.el9_2` for RHEL 9.2 SAP-related channels, and `5.14.0-570.69.1.el9_6` for RHEL 9.6. The updates include a fix for **CVE-2023-53513**, an NBD `nbd_ioctl` validation flaw in which an oversized ioctl argument could cause signed integer overflow during block-write processing and unexpected behavior when narrowed on 64-bit systems. Red Hat also shipped the corresponding real-time kernel build, `4.18.0-553.87.1.rt7.428.el8_10`, for affected RHEL 8 real-time deployments. Organizations should apply the appropriate kernel packages for their subscribed architecture and support channel, then reboot systems to activate the fixes; the advisories do not state that the listed issues are under active exploitation.
Aug 28, 2026
Red Hat released kernel security updates for multiple RHEL 8.4, 9/9.4, and 10.0 support channels, addressing vulnerabilities in networking, NFS, USB audio, Wi-Fi, Bluetooth, storage, cryptography, EFI handling, and speculative-execution mitigations. The advisories include builds `4.18.0-305.182.1.el8_4` for RHEL 8.4 AUS and long-life systems, `5.14.0-427.100.1.el9_4` for RHEL 9.4, and `6.12.0-55.52.1.el10_0` for RHEL 10.0 Extended Update Support and related channels. Among the fixed issues is **CVE-2025-39697**, a Moderate-severity NFS write-path use-after-free race that an authenticated client with write access to an NFS export could exploit through carefully timed concurrent writes to crash the kernel, causing remote denial of service. Updates also remediate the ALSA USB-audio out-of-bounds flaw **CVE-2022-48701** and other bounds-checking, use-after-free, and protocol-handling defects; Red Hat advises customers to reboot after installation so the patched kernel is loaded. Disabling automatic loading of the NFS kernel module can reduce exposure to CVE-2025-39697 where NFS is not required.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026