Loading story…
Red Hat released two Important security advisories for the Linux kernel in Red Hat Enterprise Linux 9.6 Extended Update Support, updating affected systems first to 5.14.0-570.129.1.el9_6 and later to 5.14.0-570.132.1.el9_6. The earlier advisory addressed eight kernel CVEs spanning components including VMCI, vt, Bluetooth, AMD display, SMB client, traffic scheduling, xfrm, and DRM GEM, alongside several bug fixes and enhancements. Red Hat said affected systems must be rebooted after applying the packages.
A subsequent advisory fixed three additional kernel vulnerabilities: CVE-2025-71131, CVE-2026-46054, and CVE-2026-52976. Red Hat’s Bugzilla entry for CVE-2025-71131 said the flaw was in the kernel crypto: seqiv code, where req->iv could be used after crypto_aead_encrypt returns even though the underlying request may already have been freed through asynchronous completion; the fix replaces that unsafe post-call check with a separate variable, unaligned_info. Red Hat said the issue was remediated for RHEL 9.6 EUS through RHSA-2026:52667, and customers were again instructed to apply the update and reboot.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A vulnerability notice for Red Hat Enterprise Linux 9.6 EUS kernel packages reports that a patch was published for RHSA-2026:60486. The affected package family includes standard, 64K-page, real-time, debug, development, tools, and performance-related kernel components; no known exploits were reported.
On 2026-08-10, Red Hat published Important advisory RHSA-2026:52667 for Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. The update shipped kernel version 5.14.0-570.132.1.el9_6 and fixed CVE-2025-71131, CVE-2026-46054, and CVE-2026-52976.
On 2026-07-23, Red Hat published Important advisory RHSA-2026:44385 for Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. The update shipped kernel version 5.14.0-570.129.1.el9_6 and fixed eight kernel CVEs, including flaws in VMCI, vt, Bluetooth, AMD display, SMB client, traffic scheduling, xfrm, and DRM GEM.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for the Linux kernel across **RHEL 8, RHEL 9, and RHEL 10**, including `kernel-rt` for Real Time deployments, fixing vulnerabilities in core subsystems such as **SMB/CIFS client code, iSCSI target handling, SMC, `sched/psi`, `memfd`, UDF, netfilter, POSIX CPU timers, and AMD GPU drivers**. The advisories cover **nine CVEs in RHEL 8**, **26 CVEs in RHEL 9**, and **24 CVEs in RHEL 10**, with affected offerings spanning standard, Extended Life Cycle, Extended Update Support, SAP, NFV, and CodeReady Linux Builder channels across **x86_64, s390x, ppc64le, and aarch64**. Red Hat said systems should be **rebooted after applying the updates** and reiterated that kernel errata should be treated as security-relevant because of the kernel’s central role. Among the patched flaws, Red Hat detailed **`CVE-2026-53143`**, a **buffer overflow** in the `drm/amdkfd` driver on **GFX11** that could leak or corrupt adjacent GTT memory during CRIU checkpoint and restore operations because SDMA queues used compute-specific handlers with the wrong MQD size. The company also fixed **`CVE-2026-63952`** in **`memfd`**, where writable mappings could persist even when `SEAL_EXEC` implicitly applied `SEAL_WRITE`, weakening the expected write-seal guarantees and undermining **W^X** protections. The RHEL 9 advisory also includes non-security fixes, including a regression in `5.14.0-687.5.1.el9_8` that broke Wi-Fi when **FIPS** was enabled.
Sep 5, 2026
Red Hat released a series of **kernel security advisories** across **RHEL 8** and **RHEL 9** product lines, covering standard, real-time, SAP, telecommunications, NFV, and extended life cycle channels. The updates address multiple high-impact flaws including `CVE-2026-23216` (use-after-free in iSCSI target code), `CVE-2026-45984` (use-after-free in the GFS2 iomap inline data write path), `CVE-2026-46189` (double free in `RDMA/vmw_pvrdma`), `CVE-2026-23191` (ALSA aloop), `CVE-2026-23401` (KVM privilege escalation or denial of service), and `CVE-2026-31431` (crypto `algif_aead`). Red Hat also disclosed broader kernel rollups for some RHEL 8.6 and 8.8 channels, including fixes for older and newer CVEs spanning NVMe, IPv6, tunneling, networking, memory corruption, overflow, and denial-of-service conditions. The advisories include **Important** and **Critical** ratings depending on the affected branch, with one RHEL 8.6 Extended Update Support and Advanced Mission Critical update fixing **16 kernel vulnerabilities**. Affected offerings include RHEL 8.6, 8.8, and 8 standard and specialized variants, plus RHEL 9.2 SAP-related builds across `x86_64`, `ppc64le`, `aarch64`, and `s390x`. Red Hat said updated kernel packages are available for each channel, noted some releases also include non-security fixes such as an `.sbat` section addition and an NFS log correction, and instructed customers to **reboot systems after applying the updates** for protections to take effect.
Aug 25, 2026
Red Hat released a series of **kernel** and **kernel-rt** security advisories affecting **RHEL 7 ELS, RHEL 8, RHEL 9, and RHEL 10** product streams, including AUS, EUS, SAP Solutions, Telecommunications, Extended Life Cycle, and Extended Update Support channels. The updates fix clusters of vulnerabilities across networking, storage, memory management, and filesystem components, with repeated remediation for flaws such as `CVE-2026-23270` in traffic control `act_ct`, `CVE-2026-31419` in the bonding driver, `CVE-2026-43163` in `md/bitmap`, and multiple libceph, netfilter, RDMA, SMB, IPv6, SCTP, ALSA, and BPF issues. Red Hat rated several advisories **Important** and some **Critical**, citing impacts that include denial of service, memory corruption, out-of-bounds reads, use-after-free conditions, and possible local privilege escalation. The advisories span updated kernel builds including `3.10.0-1160.151.1.el7`, `4.18.0-305.197.1.el8_4`, `4.18.0-477.150.1.el8_8`, `4.18.0-553.132.1.el8_10`, `5.14.0-284.176.1.el9_2`, `5.14.0-427.127.1.el9_4`, `5.14.0-570.119.1.el9_6`, and `6.12.0-55.82.1.el10_0`, and Red Hat said affected systems must be **rebooted** after patching. One separately documented flaw, `CVE-2025-71116`, was traced to libceph `decode_pool()` parsing of malformed `osdmap` data, allowing an authenticated remote Ceph OSD or monitor to crash a client kernel; Red Hat said the issue was fixed with explicit bounds checks and advised preventing the `libceph` module from loading where Ceph is not used.
Aug 25, 2026