Loading story…
Red Hat updated the rhel8/go-toolset and OpenShift Dev Spaces devspaces/udi-rhel8 container images to incorporate Linux kernel security fixes from RHSA-2024:10943. The updates remediate multiple kernel flaws affecting RHEL 8, including CVE-2024-46695, a permission-check bypass in the SELinux and Smack inode_setsecctx path, alongside information-disclosure, crash, race-condition, dangling-pointer, network-stack, and ARM64 uprobe issues.
CVE-2024-46695 could allow a root user on an NFS client to alter security labels on files in an NFS export despite root squashing, because the vulnerable code bypassed required Linux Security Module permission checks. The kernel fix restores enforcement by replacing __vfs_setxattr_noperm() with __vfs_setxattr_locked(). Red Hat advised customers to upgrade affected container images, update image references in Dockerfiles and automation, and rebuild dependent images; updated Dev Spaces images are available for x86_64, ppc64le, and s390x.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updated OpenShift Dev Spaces 3 container images through the Red Hat Container Registry, incorporating backported security fixes from `RHSA-2023:7077`. The updated dashboard, plugin-registry, and UDI images are available for `x86_64`, `ppc64le`, and `s390x`; organizations should upgrade the images and rebuild dependent container images. The remediation covers numerous Linux kernel issues, including `CVE-2022-3594`, which can let a remote attacker force excessive logging through the Realtek `r8152` USB Ethernet driver, and local denial-of-service flaws in the VMware graphics driver: `CVE-2022-40133` and `CVE-2022-38457`. It also includes `CVE-2022-45869`, a KVM race condition that can allow a low-privileged nested-virtualization guest user to crash or corrupt host memory. Where updates cannot be applied immediately, Red Hat recommends blacklisting unneeded `r8152` or `vmwgfx` kernel modules and disabling nested virtualization for the KVM issue.
Aug 26, 2026
Red Hat released updated Red Hat Enterprise Linux 9 and OpenShift Dev Spaces 3 container images incorporating kernel security fixes from `RHSA-2025:2627`. The refreshed images cover x86_64, ARM64, IBM Z (`s390x`), and little-endian Power (`ppc64le`) variants, including applicable EUS, ELS, AUS, and SAP offerings. Red Hat instructed customers to update image references in Dockerfiles and automation and rebuild all dependent container images. The fixes include `CVE-2024-50302`, a Linux kernel HID-core vulnerability in which an uninitialized report buffer could expose kernel memory through a specially crafted HID report. The upstream remediation zero-initializes the buffer at allocation; the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog. The advisories also backport fixes for additional kernel flaws involving null-pointer dereferences, use-after-free and dangling-pointer conditions, uninitialized buffers, and out-of-bounds access.
Aug 26, 2026
Red Hat released Important RHEL kernel updates addressing multiple Linux kernel flaws, including **CVE-2022-0492**, in which abuse of the cgroups v1 `release_agent` feature can enable local privilege escalation and bypass namespace isolation, creating a container-escape path. The upstream fix is tracked in commit `24f6008564183aa120d07c03d9289519c2fe02af`; related kernel issues include **CVE-2022-0847 (Dirty Pipe)**, file-descriptor handling defects, missing TLB flushing, usercopy use-after-free conditions, kernel memory read/write flaws, and TIPC denial of service. Affected updates include RHEL 8 kernel `4.18.0-348.20.1.el8_5` across x86_64, ARM64, IBM Z, and Power LE variants, as well as `kernel-rt` packages for RHEL 8.2 Real Time Telecommunications and NFV Telecommunications Update Service on x86_64. Organizations should apply the applicable updated kernel packages and reboot hosts to activate the fixes. Red Hat assessed OpenShift Container Platform clusters with SELinux enabled by default as protected against the CVE-2022-0492 container-escape and privilege-escalation path.
Aug 27, 2026