Loading story…
Red Hat released important updates for RHEL 8 Real Time and Red Hat Virtualization Host 4 to remediate seven Linux kernel vulnerabilities, including CVE-2021-4154 and CVE-2022-0435. CVE-2021-4154 is a use-after-free flaw in the cgroup v1 parser’s handling of fsconfig parameters that a local attacker can use for privilege escalation, container escape, or denial of service. The affected Real Time update is kernel-rt 4.18.0-348.20.1.rt7.150.el8_5; Red Hat Virtualization Host 4 received version 4.4.10, along with updated host-release packages.
CVE-2022-0435 affects the kernel’s TIPC networking module and can remotely trigger a stack overflow and kernel panic on systems using TIPC, causing denial of service. In configurations lacking effective stack protections, the issue could potentially lead to remote code execution when an attacker can obtain a stack canary. The virtualization advisory also addresses a Cyrus SASL flaw that could permit arbitrary SQL-command execution. Organizations running affected RHEL 8, Real Time, NFV, extended-support, or Red Hat Virtualization deployments should apply the applicable updates and reboot systems, particularly where containers or TIPC are enabled.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2022:1589 for RHEL 8.1 Update Services for SAP Solutions, providing kernel version 4.18.0-147.65.1.el8_1 for x86_64 and Power LE systems. The update remediated the CVE-2022-0435 TIPC stack-overflow vulnerability and required a reboot.
Red Hat issued Important advisory RHSA-2022:1186, providing a kpatch-patch live kernel module for supported RHEL 8.2 EUS, AUS, TUS, and SAP Solutions channels. The live patch remediated the CVE-2022-0435 TIPC remote stack-overflow vulnerability without a traditional reboot-based kernel update.
Red Hat issued Important advisory RHSA-2022:1213 for RHEL 8.2 Extended Update Support and associated update channels. Kernel version 4.18.0-193.80.1.el8_2 remediated CVE-2022-0435, CVE-2020-8647, and CVE-2020-8649; affected systems required a reboot.
Red Hat issued Important advisory RHSA-2022:1209 for RHEL 8.2 Extended Update Support Real Time Telecommunications and NFV offerings. Kernel-rt version 4.18.0-193.80.1.rt13.130.el8_2 remediated CVE-2022-0435, CVE-2020-8647, and CVE-2020-8649; affected systems required a reboot.
A comment noted that the not-yet-built CentOS Stream 8 kernel-4.18.0-373.el8 appeared to lack the CVE-2022-0435 fix according to its changelog, despite the related tracking bug being closed.
Red Hat closed its bug tracking CVE-2022-0435 after issuing fixes across affected RHEL 8 variants and Red Hat Virtualization 4.
Red Hat issued Important advisory RHSA-2022:0819 for RHEL 8 Real Time kernel packages. The update supplied kernel-rt 4.18.0-348.20.1.rt7.150.el8_5 and remediated seven kernel flaws, including CVE-2021-4154 and CVE-2022-0435.
Red Hat issued RHSA-2022:0771 and RHSA-2022:0772 for RHEL 8.4 Extended Update Support, updating kernel-rt and kpatch-patch packages to remediate the Linux kernel TIPC stack-overflow flaw CVE-2022-0435.
Marian Rehak described CVE-2022-0435, a remote stack-overflow vulnerability in the Linux kernel TIPC networking module that can trigger a kernel panic and denial of service on affected systems.
Red Hat issued Important advisory RHSA-2022:0231, supplying a kpatch-patch live-update module for supported RHEL 8.4 channels. The update remediated CVE-2021-4154, CVE-2021-4155, and CVE-2022-0185 without requiring a conventional reboot.
Red Hat issued Important advisory RHSA-2022:0187 for Real Time Linux Kernel packages on RHEL 8.4 Extended Update Support variants. The kernel-rt 4.18.0-305.34.2.rt7.107.el8_4 update remediated CVE-2021-4154, CVE-2021-4155, and CVE-2022-0185; affected systems required a reboot after installation.
Red Hat closed its bug record for CVE-2022-0185, the Linux kernel Filesystem Context legacy_parse_param heap-overflow vulnerability, after issuing updates for affected RHEL 8, RHEL 8.4 EUS, and Red Hat Virtualization 4 products.
Red Hat Product Security DevOps closed the bug for CVE-2021-4154, a Linux kernel cgroup v1 parser use-after-free issue that could enable local privilege escalation, container escape, or denial of service.
Red Hat issued Important advisory RHSA-2022:0841 for Red Hat Virtualization Host 4 on RHEL 8, delivering version 4.4.10. The update addressed kernel vulnerabilities including CVE-2021-4154 and CVE-2022-0435, as well as the Cyrus SASL SQL-command-execution flaw CVE-2022-24407.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important RHEL kernel updates addressing multiple Linux kernel flaws, including **CVE-2022-0492**, in which abuse of the cgroups v1 `release_agent` feature can enable local privilege escalation and bypass namespace isolation, creating a container-escape path. The upstream fix is tracked in commit `24f6008564183aa120d07c03d9289519c2fe02af`; related kernel issues include **CVE-2022-0847 (Dirty Pipe)**, file-descriptor handling defects, missing TLB flushing, usercopy use-after-free conditions, kernel memory read/write flaws, and TIPC denial of service. Affected updates include RHEL 8 kernel `4.18.0-348.20.1.el8_5` across x86_64, ARM64, IBM Z, and Power LE variants, as well as `kernel-rt` packages for RHEL 8.2 Real Time Telecommunications and NFV Telecommunications Update Service on x86_64. Organizations should apply the applicable updated kernel packages and reboot hosts to activate the fixes. Red Hat assessed OpenShift Container Platform clusters with SELinux enabled by default as protected against the CVE-2022-0492 container-escape and privilege-escalation path.
Aug 27, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026