Loading story…
Red Hat released Important kernel security updates for RHEL 8.4 extended-support channels and RHEL 9.0 Extended Update Support to remediate CVE-2022-4139 and CVE-2022-2964. CVE-2022-4139 affects Intel Gen12 i915 GPUs: an incorrect GPU TLB flush can leave stale mappings that enable random memory access, potentially resulting in data exposure or memory corruption. CVE-2022-2964 is a memory-corruption vulnerability in handling AX88179_178A USB Ethernet devices.
Affected organizations should install kernel 4.18.0-305.76.1.el8_4 on applicable RHEL 8.4 deployments and 5.14.0-70.43.1.el9_0 on applicable RHEL 9.0 EUS systems, then reboot to activate the fixes. Red Hat also delivered the fixes through its RHEL 9 live-kernel-patching package, alongside remediation for a watch-queue privilege-escalation race condition and an nfsd TCP/RPC buffer-overflow flaw; the live patch is available for x86_64 and little-endian Power RHEL 9 systems.
See real exploitation activity before you spend the cycle.
15 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2023:1130 for RHEL 8.6 servicing channels, supplying kernel 4.18.0-372.46.1.el8_6. The reboot-required update remediated CVE-2022-2964, CVE-2022-41222, and CVE-2022-4269 across supported architectures.
Red Hat issued Important advisory RHSA-2023:0536, updating the kpatch-patch live kernel module for RHEL 9.0 Extended Update Support and SAP Solutions channels on x86_64 and ppc64le. The live patch remediated CVE-2022-2964 and CVE-2022-4139 without a conventional kernel reboot.
Red Hat issued Important advisory RHSA-2023:0499 for RHEL 8.4 supported update channels. The kpatch-patch live kernel module remediated CVE-2022-2964 and CVE-2022-4139 on affected x86_64 and ppc64le systems without requiring a conventional reboot.
Red Hat issued Important advisory RHSA-2023:0512 for RHEL 9.0 Extended Update Support, delivering kernel version 5.14.0-70.43.1.el9_0. The update remediated CVE-2022-4139 and CVE-2022-2964 across supported architectures and required a reboot for fixes to take effect.
Red Hat issued Important advisory RHSA-2023:0496 for RHEL 8.4 extended-support channels, providing kernel version 4.18.0-305.76.1.el8_4. The update fixed CVE-2022-4139 and the AX88179_178A USB Ethernet memory-corruption flaw CVE-2022-2964; affected systems required a reboot.
Red Hat issued Important advisory RHSA-2023:0531 for RHEL 8.4 Extended Update Support and telecommunications Real Time channels, providing kernel-rt 4.18.0-305.76.1.rt7.148.el8_4 for x86_64. The reboot-required update remediated CVE-2022-2964 and CVE-2022-4139.
Red Hat issued RHSA-2023:0399, RHSA-2023:0400, and RHSA-2023:0404 to fix CVE-2022-2964 in RHEL 7 kernel, kernel-rt, and kpatch packages. It also released RHSA-2023:0395 and RHSA-2023:0392 for affected RHEL 8.2 Advanced Update Support and Telecommunications Update Service channels.
Red Hat issued Important advisory RHSA-2023:0348, updating the kpatch-patch live kernel module for RHEL 9. The live patch remediated CVE-2022-2959, CVE-2022-2964, CVE-2022-4139, and CVE-2022-43945 on x86_64 and ppc64le systems.
Red Hat issued Important advisory RHSA-2023:0123, providing kpatch-patch-4_18_0-425_3_1-1-2.el8 for affected RHEL 8 x86_64 and ppc64le channels. The live kernel patch remediated the AX88179_178A USB Ethernet memory-corruption flaw CVE-2022-2964 and the Intel i915 GPU TLB-flush flaw CVE-2022-4139.
Red Hat issued Important advisory RHSA-2023:0114, providing kernel-rt 4.18.0-425.10.1.rt7.220.el8_7 for affected RHEL 8 Real Time and related x86_64 offerings. The reboot-required update fixed CVE-2022-2964 and CVE-2022-4139 and addressed an RT-kernel boot issue affecting systems with PERC12 controllers.
Red Hat issued Important advisory RHSA-2023:0101 for RHEL 8, providing kernel version 4.18.0-425.10.1.el8_7 across x86_64, s390x, ppc64le, and aarch64 platforms. The reboot-required update remediated the AX88179_178A USB Ethernet memory-corruption flaw CVE-2022-2964 and the Intel i915 GPU TLB-flush issue CVE-2022-4139.
Red Hat closed its medium-severity tracking bug for CVE-2021-26401, an AMD LFENCE/JMP speculative-execution mitigation weakness related to Spectre Variant 2. The issue affected AMD Zen through Zen 3 processors under a specific SMT-sibling workload and had been addressed for RHEL 8 through RHSA-2022:1975 and RHSA-2022:1988.
Marian Rehak described CVE-2022-0330, a random-memory-access flaw in the Linux Intel i915 GPU driver. A local user able to run malicious GPU code could crash an affected system or potentially escalate privileges.
Red Hat documented that an incorrect TLB flush in the Linux i915 GPU driver can enable random memory access, memory corruption or disclosure, system crashes, and possible local privilege escalation. It stated that RHEL 7 is not affected because it lacks Intel Gen12 GPU support and that no mitigation meeting its deployment and stability criteria is available.
Red Hat closed its tracking bug for the Intel i915 GPU TLB-flush vulnerability CVE-2022-4139 after issuing fixes across affected RHEL releases and Red Hat Virtualization 4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
21 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, RHEL 9, and supported extended-life, update-service, SAP, and Real Time variants. The advisories address **Native Branch History Injection** (`CVE-2024-2201`), a Spectre-v2-related speculative-execution flaw on recent Intel CPUs that can bypass FineIBT mitigations and leak kernel memory, alongside vulnerabilities in networking, storage, filesystems, device drivers, wireless code, and CPU handling. Included fixes cover an AF_UNIX garbage-collector race (`CVE-2024-26923`), improper LLSEC key-resource release in `mac802154` (`CVE-2024-26961`), an MPTCP uninitialized-state issue (`CVE-2024-40931`), USB CDC-WDM log-flooding that can trigger CPU soft lockups (`CVE-2024-40904`), and an out-of-bounds `tty` imageblit access (`CVE-2021-47383`). Organizations should install the applicable updated kernel packages—including RHEL 8.6 builds `4.18.0-372.113.1.el8_6`, `4.18.0-372.121.1.el8_6`, or `4.18.0-372.124.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026