Loading story…
Red Hat released Important RHEL kernel updates addressing multiple Linux kernel flaws, including CVE-2022-0492, in which abuse of the cgroups v1 release_agent feature can enable local privilege escalation and bypass namespace isolation, creating a container-escape path. The upstream fix is tracked in commit 24f6008564183aa120d07c03d9289519c2fe02af; related kernel issues include CVE-2022-0847 (Dirty Pipe), file-descriptor handling defects, missing TLB flushing, usercopy use-after-free conditions, kernel memory read/write flaws, and TIPC denial of service.
Affected updates include RHEL 8 kernel 4.18.0-348.20.1.el8_5 across x86_64, ARM64, IBM Z, and Power LE variants, as well as kernel-rt packages for RHEL 8.2 Real Time Telecommunications and NFV Telecommunications Update Service on x86_64. Organizations should apply the applicable updated kernel packages and reboot hosts to activate the fixes. Red Hat assessed OpenShift Container Platform clusters with SELinux enabled by default as protected against the CVE-2022-0492 container-escape and privilege-escalation path.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2022:2186 for RHEL 7.6 AUS, TUS, and SAP Update Services offerings. The reboot-required kernel 3.10.0-957.94.1.el7 update remediated CVE-2022-0492 and the RDMA listen() use-after-free flaw CVE-2021-4028.
Red Hat issued Important advisory RHSA-2022:2211, providing updated kpatch-patch live kernel modules for supported RHEL 7.6 offerings on x86_64 and ppc64le. The update remediated CVE-2022-0492 and the RDMA listen() use-after-free vulnerability CVE-2021-4028.
Red Hat issued Important advisory RHSA-2022:1455 for RHEL 8.4 Extended Update Support and related offerings, providing kernel 4.18.0-305.45.1.el8_4 for x86_64, s390x, ppc64le, and aarch64. The reboot-required update remediated CVE-2022-0492, CVE-2021-4083, and CVE-2022-25636.
Red Hat issued Important advisory RHSA-2022:1413 for RHEL 8.4 Extended Update Support real-time offerings on x86_64. The kernel-rt 4.18.0-305.45.1.rt7.117.el8_4 update fixed CVE-2022-0492 along with CVE-2021-4083 and CVE-2022-25636, and required a reboot.
Red Hat issued Important advisory RHSA-2022:0825, updating RHEL 8 kernels to version 4.18.0-348.20.1.el8_5 across supported architectures and service variants. The update remediated eight vulnerabilities, including CVE-2022-0492, and required systems to be rebooted after installation.
Red Hat issued Important advisory RHSA-2022:0821 for RHEL 8.2 Extended Update Support real-time products on x86_64. It provided kernel-rt 4.18.0-193.79.1.rt13.129.el8_2, fixing CVE-2022-0492, Dirty Pipe (CVE-2022-0847), and three other kernel flaws.
Red Hat assessed OpenShift Container Platform clusters with the default SELinux policy enabled on nodes as not affected by the CVE-2022-0492 container-escape and privilege-escalation path.
Fedora incorporated the CVE-2022-0492 fix into its stable Linux kernel version 5.16.6.
The upstream Linux kernel fixed CVE-2022-0492, a cgroups v1 release_agent flaw that could enable privilege escalation and namespace-isolation bypass, in commit 24f6008564183aa120d07c03d9289519c2fe02af.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2022:5626** for Red Hat Enterprise Linux 8.4 Extended Update Support, delivering kernel `4.18.0-305.57.1.el8_4` for x86_64, s390x, ppc64le, and aarch64. The update remediates six kernel vulnerabilities, including **CVE-2022-32250**, a netfilter use-after-free write that can enable local root escalation, and **CVE-2022-1729**, affecting `perf_event_open`. It also addresses cgroup migration permission handling in **CVE-2021-4197**, which can let a less-privileged process induce a privileged process to write through an attacker-created file descriptor, and **CVE-2021-4203**, a socket credential race that can crash the system or disclose kernel information. Red Hat also issued **RHBA-2022:5744** to update Red Hat OpenStack Platform 16.2 container images, incorporating the kernel security fixes for x86_64 and IBM Power ppc64le deployments. Organizations should install the applicable RHEL kernel update and reboot hosts for remediation to take effect; OpenStack Platform users should upgrade the supplied container images and rebuild dependent images.
Aug 26, 2026
Red Hat released important updates for **RHEL 8 Real Time** and **Red Hat Virtualization Host 4** to remediate seven Linux kernel vulnerabilities, including `CVE-2021-4154` and `CVE-2022-0435`. `CVE-2021-4154` is a use-after-free flaw in the cgroup v1 parser’s handling of `fsconfig` parameters that a local attacker can use for privilege escalation, container escape, or denial of service. The affected Real Time update is kernel-rt `4.18.0-348.20.1.rt7.150.el8_5`; Red Hat Virtualization Host 4 received version 4.4.10, along with updated host-release packages. `CVE-2022-0435` affects the kernel’s TIPC networking module and can remotely trigger a stack overflow and kernel panic on systems using TIPC, causing denial of service. In configurations lacking effective stack protections, the issue could potentially lead to remote code execution when an attacker can obtain a stack canary. The virtualization advisory also addresses a Cyrus SASL flaw that could permit arbitrary SQL-command execution. Organizations running affected RHEL 8, Real Time, NFV, extended-support, or Red Hat Virtualization deployments should apply the applicable updates and reboot systems, particularly where containers or TIPC are enabled.
Aug 27, 2026
Red Hat released kernel security updates across **RHEL 7 Extended Life Cycle Support**, RHEL 8 and its real-time variants, RHEL 9.2 SAP-related lifecycle channels, and RHEL 10. The advisories remediate multiple memory-safety and denial-of-service issues, including use-after-free flaws in the page-pool subsystem (`CVE-2025-38129`) and the teql queueing discipline (`CVE-2026-23074`). The page-pool race can result in a freed page pool being accessed during page recycling and may enable arbitrary code execution; the teql flaw may enable local privilege escalation. Other fixes address buffer overflows, NULL-pointer dereferences, slab out-of-bounds conditions, and flaws in Squashfs, BPF sockmap, SCTP, IPv6, and procfs code paths. Organizations should apply the relevant Red Hat kernel builds, including `4.18.0-553.107.1.el8_10` for affected RHEL 8 deployments and `5.14.0-284.161.1.el9_2` for applicable RHEL 9.2 SAP systems. Red Hat requires affected systems to be rebooted after installation for the updated kernel and mitigations to take effect; teams should prioritize systems where untrusted local users or workloads can access vulnerable kernel functionality.
Aug 28, 2026