Linux kernel's Mutagen Astronomy flaw CVE-2018-14634 used in attacks; fixes available
Attackers are using an old Linux flaw to turn existing access into administrator control. It affects certain older kernels, with fixes available for years. Ask whoever maintains your Linux computers or servers to verify the vendor's kernel update is running.
If you use an older Linux computer, install its vendor's kernel security updates and restart. Ask your IT provider to verify that any Linux servers you rely on are running a kernel fixed for CVE-2018-14634, and to check saved system images too.
- Ubuntu 14.04 LTS (standard linux kernel)fixed in 3.13.0-160.210 and later
- Ubuntu 16.04 LTS (standard linux kernel)fixed in 4.4.0-93.116 and later
What’s happening
CVE-2018-14634, nicknamed Mutagen Astronomy, is an integer overflow in the Linux kernel's program-loading code. Someone already able to run programs locally can use it to gain administrator privileges through a privileged program. It affects certain older 64-bit Linux systems, including Red Hat Enterprise Linux 6 and 7 and older Ubuntu kernels; it does not affect every Linux release. Red Hat lists fixes for its affected product families, and Canonical records fixes for affected Ubuntu kernels. Ubuntu's standard kernels from 18.04 onwards in its advisory are marked unaffected. CISA confirmed exploitation on 26 January 2026. The reviewed sources do not identify victims or attackers, and CISA lists ransomware use as unknown. Fixes remain available; administrators must install the correct vendor update and restart into the updated kernel.
- What
- Flaw
- Affects
- Linux kernel in older Linux computers and servers
- Affected
- Red Hat Enterprise Linux 6 and 7: affected 64-bit kernel builds
Red Hat Enterprise Linux for Real Time for NFV 7
Red Hat MRG Grid for RHEL 6 Server v.2
Ubuntu 14.04 LTS standard linux package before 3.13.0-160.210
Ubuntu 16.04 LTS standard linux package before 4.4.0-93.116; some alternative kernel packages have separate fixed versions - Fixed in
- Red Hat Enterprise Linux 7: kernel updates under RHSA-2018:2748
Red Hat Enterprise Linux 6: kernel updates under RHSA-2018:2846
Red Hat Enterprise Linux for Real Time for NFV 7: kernel-rt updates under RHSA-2018:2763
Red Hat MRG Grid for RHEL 6 Server v.2: kernel-rt updates under RHSA-2018:3586
Red Hat Enterprise Linux 7.4 affected update-support branches: kernel 3.10.0-693.43.1.el7
Ubuntu 14.04 LTS standard linux package: 3.13.0-160.210
Ubuntu 16.04 LTS standard linux package: 4.4.0-93.116 - Since
- 26 Jan 2026
- Closed
- 2 Feb 2026
Timeline
- Update
Qualys, which discovered the flaw, reiterated that attackers need local access. It urged administrators to check old system images and templates as well as running machines, because these can reintroduce the vulnerability.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 16 February remediation deadline for US federal civilian agencies; ransomware use is listed as unknown.
- New fix
Red Hat released kernel 3.10.0-693.43.1.el7 for affected Red Hat Enterprise Linux 7.4 update-support branches. A restart is required to activate the fix.
- Made public
CVE-2018-14634 was publicly disclosed. The Linux kernel flaw allows someone with local access to gain administrator privileges.
Sources
- Mutagen Astronomy — Local privilege escalation — CVE-2018-14634Red Hat · 3 Sept 2021
- RHSA-2018:3540 — Important: kernel security, bug fix, and enhancement updateRed Hat · 13 Nov 2018
- CVE-2018-14634Red Hat · 25 Sept 2018
- CVE-2018-14634Canonical · 4 July 2026
- Known Exploited Vulnerabilities catalogueCISA · 3 Nov 2026
- Mutagen Astronomy: From Discovery to CISA Recognition—A Seven-Year JourneyQualys · 2 Feb 2026
- U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 27 Jan 2026