Red Hat Security Advisory: kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1
Affects Red HatSource GCVE Database
Not known to be exploited.
Data as of 30 Oct 2026, 11:52 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 1.3% chance of exploitation in 30 days – higher than 71% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
AI-suggested
Red Hat has released official kpatch-patch updates for Red Hat Enterprise Linux 9.2 to fix this vulnerability. Users should apply the provided kpatch-patch updates for kernel-5.14.0-284.117.1.el9_2 and related versions as detailed in Red Hat Advisory RHSA-2026:44003. Instructions for applying the live patch updates are available in the Red Hat knowledge base article https://access.redhat.com/articles/11258. Applying these patches mitigates the vulnerability. No additional actions are required beyond applying the official updates.
Description
A security flaw in the Red Hat Enterprise Linux kernel live patch module for kernel-5.14.0-284.117.1.el9_2 allows a use-after-free vulnerability in KVM x86 shadow paging due to an unexpected role. This vulnerability is identified as CVE-2026-53359 and has been rated with high severity by Red Hat Product Security. The issue is addressed by updated kpatch-patch packages for Red Hat Enterprise Linux 9.2. The patch modifies the running kernel code to fix the use-after-free condition. No public exploit code or in-the-wild exploitation is currently known.