OSG-SEC-2023-05-18 HIGH Linux kernel user-after-free flaw in TLS protocol
Dear OSG Security Contacts,
A use-after-free flaw was found in the Linux kernel's TLS protocol functionality in how a user installs a TLS context (struct tls_context) on a connected TCP socket (CVE-2023-0461). 
RHEL 8 and 9 based distributions
WHAT ARE THE VULNERABILITIES:
This flaw allows a local user to crash or potentially escalate their privileges on the system. 
WHAT YOU SHOULD DO:
Update your Linux kernel to the latest patched version. Updated kernel packages for all impacted RHEL based distributions are now available. It may take a few more days for them to show up in CentOS. 
If you are unable to update your kernel, Red Hat recommends the following:
To mitigate this issue, prevent module 'tls' from being loaded. Please see  for how to blacklist a kernel module to prevent it from loading automatically.
Note: RHEL 7 based distributions, like Scientific Linux, are not affected.
Please contact the OSG security team at [email protected] if you have any questions or concerns.
OSG Security Team