Loading story…
Red Hat remediated CVE-2022-2078, a moderate-severity classic buffer overflow (CWE-120) in the Linux kernel Netfilter/nftables function nft_set_desc_concat_parse(). A low-privileged local attacker could trigger the flaw to cause denial of service and potentially execute code. The vulnerability was fixed upstream in commit fecf31ee395b0295f2d7260aa29946b7605f7c85; CVE-2022-1972 was identified as a duplicate CVE for the same issue.
Affected Red Hat products received updated kernel packages for RHEL 8, RHEL 9, and Red Hat Virtualization 4 on RHEL 8; RHEL 6 and RHEL 7 kernels were not affected. RHSA-2022:6582 delivered the RHEL 9 kernel-rt fix in version 5.14.0-70.26.1.rt21.98.el9_0, alongside remediation for CVE-2022-34918. Organizations should install the applicable kernel updates and reboot systems, as no separate Red Hat-supported mitigation was available.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat fixed affected RHEL 8 kernel-rt packages through RHSA-2022:7444 and kernel packages through RHSA-2022:7683.
Red Hat issued RHSA-2022:6582 for RHEL 9 kernel-rt and RHSA-2022:6610 for the RHEL 9 kernel, addressing CVE-2022-2078. The kernel-rt advisory supplied version 5.14.0-70.26.1.rt21.98.el9_0 and required affected systems to reboot after installation.
Red Hat addressed CVE-2022-2078 for the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 on RHEL 8 through RHSA-2024:0724.
Red Hat closed the Bugzilla issue associated with CVE-2022-2078 and directed subsequent product-status updates to its CVE page.
The upstream Linux kernel project fixed the vulnerability in commit fecf31ee395b0295f2d7260aa29946b7605f7c85, modifying net/netfilter/nf_tables_api.c.
CVE-2022-2078 was identified in the Linux kernel Netfilter/nftables function nft_set_desc_concat_parse(). A low-privileged local attacker could trigger a buffer overflow causing denial of service and potentially unauthorized code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat resolved **CVE-2024-54456**, a moderate-severity buffer-overflow flaw in the Linux kernel NFS client function `nfs_sysfs_link_rpc_client()`. The function appended an RPC program name of unknown length to a fixed 64-byte buffer using unsafe `strcat()` operations, creating a CWE-120 classic buffer-overflow condition. A local low-privileged attacker could potentially disclose information, corrupt memory, execute unauthorized code or commands, or cause a denial of service; Red Hat rates the issue CVSS 7.1, while NVD and CVE.org score it 7.8. The upstream remediation replaces the unsafe string handling with bounded `strscpy()` and `strncat()` calls. Red Hat issued corrected kernels for RHEL 9 and RHEL 10 and later supplied a fix for RHEL 9.6 Extended Update Support; organizations should apply the applicable kernel advisories and reboot into the updated kernel. Red Hat states that the RHEL 9 `kernel-rt` package will not receive a fix, and RHEL 8 is outside the supported remediation scope.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released moderate-severity updates for the standard Linux kernel and Real Time Linux Kernel in **RHEL 9**, delivering `kernel-rt-5.14.0-162.6.1.rt21.168.el9_1` for x86_64 and corresponding kernel packages across x86_64, ARM64, IBM Z, and Power. The updates remediate numerous vulnerabilities, including memory-safety defects that could enable local privilege escalation, information disclosure, denial of service, out-of-bounds writes, TCP session injection or termination, and AMD and Intel speculative-execution issues including RetBleed-related weaknesses. Among the fixed flaws is **CVE-2022-1016**, a Netfilter/nf_tables defect in `nft_do_chain()` in which uninitialized stack registers could leak kernel pointers to userspace. The upstream fix initializes those registers; Red Hat shipped remediations for RHEL 8 and 9 through multiple advisories. Organizations running affected RHEL 9 standard or real-time kernels should apply the relevant updates and reboot systems, as the kernel fixes do not take effect until restart.
Aug 26, 2026