Loading story…
Red Hat released Important Linux-kernel updates for RHEL 8, RHEL 9, and RHEL 8.1 Update Services for SAP Solutions to address CVE-2022-32250, a netfilter nf_tables use-after-free write that a local attacker could exploit to gain root privileges. The advisories also remediate CVE-2022-1012, in which predictable TCP source-port generation can allow a network observer to fingerprint hosts, infer traffic patterns, and estimate outbound connections. RHEL 9 updates additionally address CVE-2022-1729, a perf_event_open race condition permitting privilege escalation, and an IPsec ESP buffer-overflow flaw.
Affected administrators should install the applicable updated kernel packages and reboot systems for the fixes to take effect; RHEL 8 version 4.18.0-372.19.1.el8_6 was provided for supported variants and x86_64, aarch64, ppc64le, and s390x architectures. The updates also include stability and performance corrections affecting dm-integrity, SR-IOV, SCTP, asymmetric TCP routing, and virtual-machine booting. Tracking for the netfilter flaw should use CVE-2022-32250: CVE-2022-1966 was rejected as a duplicate. Red Hat notes RHEL 7 is not affected by CVE-2022-1012 because it uses a different TCP port-selection algorithm.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2022:6073 for RHEL 7.7 AUS, TUS, and Update Services for SAP Solutions, remediating the netfilter use-after-free privilege-escalation flaw CVE-2022-32250. The advisory provided kernel version 3.10.0-1062.68.1.el7 and required systems to reboot after installation.
Red Hat issued RHSA-2022:5805 for RHEL Server Advanced Update Support 7.4 on x86_64, remediating the netfilter use-after-free privilege-escalation vulnerability CVE-2022-32250. The update supplied kernel version 3.10.0-693.104.1.el7 and required systems to reboot after installation.
Red Hat issued RHSA-2022:5802 for RHEL 7.6 AUS, TUS, and SAP Solutions offerings, fixing the netfilter use-after-free privilege-escalation flaw CVE-2022-32250. The advisory supplied kernel version 3.10.0-957.95.1.el7 and required affected systems to reboot after installation.
Red Hat released RHSA-2022:5834 to fix CVE-2022-1012 in the RHEL 8 kernel-rt package.
Red Hat issued an Important RHEL 8 kernel update, version 4.18.0-372.19.1.el8_6, addressing CVE-2022-1012 and CVE-2022-32250 across supported architectures and product variants. The update also contained multiple kernel bug fixes and required a reboot.
Red Hat issued RHEL 8.4 Extended Update Support kernel and kernel-rt fixes through RHSA-2022:5626 and RHSA-2022:5633 for the affected kernel vulnerabilities.
RHSA-2022:5636 provided an Important kernel update for RHEL 8.1 Update Services for SAP Solutions on x86_64 and ppc64le. It remediated CVE-2022-1012, CVE-2022-1729, and CVE-2022-32250 and required a reboot after installation.
Red Hat released RHEL 9 kernel-rt and kpatch-patch updates for the affected vulnerabilities, including CVE-2022-1012 and CVE-2022-32250.
Red Hat issued an Important RHEL 9 kernel update addressing CVE-2022-1012, CVE-2022-1729, the netfilter use-after-free issue, and CVE-2022-27666, alongside reliability and performance fixes. Administrators were instructed to reboot after installation.
Red Hat released RHEL 8.2 Extended Update Support kernel and kernel-rt updates that addressed CVE-2022-1012 and the netfilter use-after-free flaw tracked as CVE-2022-32250.
Red Hat issued kernel, kernel-rt, and kpatch-patch fixes for RHEL 7 addressing the netfilter use-after-free vulnerability tracked as CVE-2022-32250 (formerly CVE-2022-1966).
Red Hat designated CVE-2022-1966 as a rejected candidate because it duplicated CVE-2022-32250, the identifier for the Linux netfilter/nf_tables use-after-free vulnerability.
Red Hat released an RHEL 8.2 EUS kpatch-patch update, RHEL 9 kernel update, and Red Hat Virtualization 4 for RHEL 7 update addressing the netfilter use-after-free flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important Linux kernel and real-time kernel updates across RHEL 7, 8, and 9, including Extended Update Support, AUS, Telecommunications Update Service, NFV, SAP, and virtualization-related variants. The updates address `CVE-2022-1729`, a `perf_event_open()` race condition through which an unprivileged local user can gain kernel exploit primitives and potentially escalate to root; netfilter use-after-free flaws including `CVE-2022-32250`/`CVE-2022-1966` that can enable root escalation; and `CVE-2022-1012`, which weakens TCP source-port randomization and can expose connection-pattern information and enable persistent fingerprinting. RHEL 9 updates also remediate `CVE-2022-27666`, a buffer overflow in IPsec ESP transformation handling. Affected organizations should deploy the applicable Red Hat kernel packages, including `kernel-rt-5.14.0-70.17.1.rt21.89.el9_0` for RHEL 9 Real Time, `kernel-rt-4.18.0-193.87.1.rt13.137.el8_2` for RHEL 8.2 Real Time EUS, and `3.10.0-514.104.1.el7` for RHEL 7.3 AUS. Red Hat also issued an RHEL 8.4 real-time EUS update covering earlier DNS cache-poisoning and security-regression issues alongside the IPsec vulnerability. Administrators must reboot systems after installation for the patched kernels to take effect.
Aug 26, 2026
Red Hat released moderate-severity updates for the standard Linux kernel and Real Time Linux Kernel in **RHEL 9**, delivering `kernel-rt-5.14.0-162.6.1.rt21.168.el9_1` for x86_64 and corresponding kernel packages across x86_64, ARM64, IBM Z, and Power. The updates remediate numerous vulnerabilities, including memory-safety defects that could enable local privilege escalation, information disclosure, denial of service, out-of-bounds writes, TCP session injection or termination, and AMD and Intel speculative-execution issues including RetBleed-related weaknesses. Among the fixed flaws is **CVE-2022-1016**, a Netfilter/nf_tables defect in `nft_do_chain()` in which uninitialized stack registers could leak kernel pointers to userspace. The upstream fix initializes those registers; Red Hat shipped remediations for RHEL 8 and 9 through multiple advisories. Organizations running affected RHEL 9 standard or real-time kernels should apply the relevant updates and reboot systems, as the kernel fixes do not take effect until restart.
Aug 26, 2026
Red Hat released Important RHEL 8 kernel updates addressing **CVE-2023-1281**, a use-after-free flaw in the Linux traffic-control `tcindex` filter. A local attacker could exploit a race involving updates to the imperfect hash area while packets traverse it, causing a freed `tcf_ext` object to be used by `tcf_exts_exec()` and potentially escalating privileges to root. Linux kernel versions from 4.14 through the upstream fix commit `ee059170b1f7e94e55fa6cadee544e176a6e59c2` are affected. The RHEL 8.2 AUS, TUS, SAP Solutions Update Services, and Telecommunications Update Service updates also remediate CVE-2023-0461, CVE-2023-1390, and CVE-2023-32233, including additional local use-after-free issues and a remotely triggerable TIPC denial of service. Organizations should install the applicable kernel packages—such as `4.18.0-193.109.1.el8_2` or the real-time `4.18.0-193.109.1.rt13.160.el8_2` release—and reboot; SAP Update Services deployments can use the supplied `kpatch` live-patch packages, which load automatically after installation on supported x86_64 and ppc64le systems.
Aug 26, 2026