Loading story…
Red Hat released Important kernel security updates for affected Red Hat Enterprise Linux 7 and 8 streams, including RHEL Server AUS 8.2, to remediate CVE-2024-36971, a known-exploited use-after-free flaw in Linux kernel network route management. A local low-privileged attacker could alter the behavior of certain network connections, potentially affecting confidentiality, integrity, and availability; Red Hat rated the issue CVSS 7.8.
For RHEL Server AUS 8.2 on x86_64, RHSA-2024:5388 provides kernel version 4.18.0-193.138.1.el8_2; systems must be rebooted after installation. Red Hat reported no practical mitigation and recommends prompt patching. Organizations using third-party KABI modules should validate compatibility, as modules that call negative_advice() may crash after the update and should be updated by their vendors or disabled until corrected.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released kernel errata for RHEL 7.7 Advanced Update Support and RHEL 7 Extended Lifecycle Support, as well as affected RHEL 8.4 Advanced Mission Critical, Telecommunications, and SAP update-service streams, to fix CVE-2024-36971.
Red Hat released RHSA-2024:5101 for the RHEL 8 kernel and RHSA-2024:5102 for RHEL 8 kernel-rt, remediating CVE-2024-36971.
Red Hat released RHSA-2024:5522, providing a kpatch-patch update for Red Hat Enterprise Linux 8 that fixes CVE-2024-36971.
Red Hat issued Important advisory RHSA-2024:5388 for RHEL Server Advanced Update Support 8.2 on x86_64. The update supplies kernel version 4.18.0-193.138.1.el8_2, fixes CVE-2024-36971 and the Intel i40e driver issue RHEL-30401, and requires a reboot after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released fixes for **CVE-2023-28466**, a moderate-severity race condition in the Linux kernel TLS subsystem's `do_tls_getsockopt` function. The flaw can trigger a use-after-free condition or NULL-pointer dereference; a local attacker with low privileges could affect system confidentiality, integrity, and availability. Red Hat rates the vulnerability **CVSS 7.0**. The remediation includes RHEL 8 kernel packages under **RHSA-2023:3847**, including `kernel-4.18.0-477.15.1.el8_8` for supported x86_64, s390x, ppc64le, and aarch64 variants, with fixes also available for affected RHEL 9 kernels. Organizations should install the applicable updates and reboot systems; where patching cannot occur immediately, Red Hat recommends preventing the TLS kernel module from loading at boot.
Aug 26, 2026
Red Hat released an Important security update for Red Hat Enterprise Linux Server AUS 7.6 that fixes **CVE-2023-4623**, a CVSS 7.8 use-after-free flaw in the Linux kernel's `net/sched` Hierarchical Fair Service Curve (HFSC) traffic-control component. A local low-privileged attacker could exploit the dangling-pointer condition to escalate privileges when HFSC handles classes using link-sharing curves under a parent without one. RHSA-2024:1747 provides kernel build `3.10.0-957.112.1.el7` and associated packages for affected x86_64 RHEL 7.6 AUS systems; fixes were also issued for affected RHEL 7 and 8 kernel, real-time kernel, and kpatch packages. Administrators should install applicable prior errata and reboot to activate the updated kernel. Until patching is complete, Red Hat recommends blacklisting the `sch_hfsc` module to prevent its automatic loading.
Aug 26, 2026
Red Hat released **Important** kernel security updates for RHEL 7.7 Advanced Update Support, RHEL 8 Real Time/NFV and 8.10 Extended Life Cycle, and RHEL 9.0 Update Services for SAP Solutions. The updates remediate an uninitialized HID report-buffer flaw (**CVE-2024-50302**), a use-after-free in CAN BCM processing (**CVE-2023-52922**), and out-of-bounds access risks in ALSA USB-audio support for Extigy and Mbox devices (**CVE-2024-53197**). The RHEL 8 `kernel-rt` update also fixes **CVE-2024-57979**, a PPS subsystem use-after-free that can occur when a PPS source is unregistered while character-device operations remain open, potentially causing memory corruption and kernel panic. Organizations should deploy the applicable fixed packages—including `kernel-rt-4.18.0-553.44.1.rt7.385.el8_10`, `kernel-3.10.0-1062.93.1.el7`, or `kernel-rt-5.14.0-70.125.1.rt21.197.el9_0`—and reboot affected hosts to activate the patched kernel; the advisories do not report known in-the-wild exploitation.
Aug 26, 2026