Loading story…
Red Hat released a series of Important security updates for Red Hat Enterprise Linux and OpenShift Container Platform to address Linux kernel vulnerabilities including CVE-2025-40026 in KVM on x86 and CVE-2026-52923 in the SysV IPC checkpoint/restore path. The KVM flaw affects nested virtualization: after KVM has allowed an L2 guest I/O operation, changes to L1 or host userspace I/O interception during the userspace exit can cause KVM to wrongly re-check intercepts, leave vcpu->arch.pio.count non-zero, trigger a WARN, and disrupt guest execution. The IPC flaw stems from ipc_idr_alloc() passing ids->next_id to idr_alloc() without enforcing the valid ipc_mni range, allowing out-of-range allocation, stale IDR entries, and a potential use-after-free during /proc/sysvipc/shm traversal.
Affected fixes were published across multiple product streams, including RHEL 8.4, RHEL 8.8, RHEL 9.4, RHEL 9.6, and OpenShift Container Platform 4.18.53, alongside other kernel CVEs such as CVE-2025-10263, CVE-2026-31787, and CVE-2026-53059. Red Hat rated both headline issues as Moderate, but noted that CVE-2026-52923 has been associated with a reported local privilege-escalation exploit targeting RHEL 10, while CVE-2025-40026 can be mitigated by disabling nested virtualization for kvm_intel and kvm_amd. Red Hat said updated kernel packages and release images are available for multiple architectures and advised customers to reboot systems after applying kernel updates and upgrade OpenShift clusters through the supported release channels.
See real exploitation activity before you spend the cycle.
20 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:59091, an Important kernel security advisory for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On that fixes CVE-2025-40026.
Red Hat released OpenShift Container Platform 4.18.53 as an Important security update that includes a fix for CVE-2025-40026 alongside other vulnerabilities.
Red Hat published RHSA-2026:52649, an Important kernel security advisory for RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service that includes a fix for CVE-2026-52923.
Red Hat published RHSA-2026:49031, an Important kernel security advisory for RHEL 9.6 Extended Update Support and related channels that fixes CVE-2025-40026 and CVE-2026-52923.
Red Hat published RHSA-2026:48386, an Important kernel security advisory for RHEL 9.4 Update Services for SAP Solutions and related variants that fixes CVE-2025-40026 and CVE-2026-52923.
Red Hat published RHSA-2026:47248, an Important kernel security advisory for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On that includes a fix for CVE-2026-52923.
Red Hat states CVE-2025-40026 was addressed for Red Hat Enterprise Linux 9 in advisory RHSA-2026:45192.
Red Hat states CVE-2025-40026 was fixed for Red Hat Enterprise Linux 8 through advisories RHSA-2026:45115 and RHSA-2026:45116.
Red Hat published its CVE entry for CVE-2026-52923, classifying the Linux kernel IPC ID allocation bug as a moderate-severity use-after-free issue with primarily local denial-of-service impact.
An upstream advisory for CVE-2026-52923 was published, documenting a Linux kernel SysV IPC checkpoint/restore flaw caused by unbounded next_id allocation in ipc_idr_alloc().
Red Hat published RHSA-2026:13577, an Important kernel security advisory for Red Hat Enterprise Linux 8. The update remediates multiple Linux kernel vulnerabilities, including CVE-2026-23401 in KVM, and provides updated kernel packages for RHEL 8 and Extended Life Cycle 8.10 variants.
Red Hat published its CVE record for CVE-2026-31402, describing an Important-severity heap overflow in the Linux kernel's NFSv4.0 server component nfsd that can lead to arbitrary code execution or denial of service. The entry also notes that multiple Red Hat Enterprise Linux kernel packages are fixed through later security errata.
Red Hat published its CVE record for CVE-2025-40026, describing a Linux kernel KVM x86 flaw involving incorrect re-checking of L1 intercepts during userspace I/O completion in nested virtualization.
A public local privilege escalation exploit targeting RHEL 10 for CVE-2026-52923 was reported as released, with the exploit referenced in the NebuSec CyberMeowfia GitHub repository.
Red Hat lists Red Hat Enterprise Linux 10 as fixed for CVE-2026-52923 in RHSA-2026:53330.
Red Hat lists Red Hat Enterprise Linux 10.0 Extended Update Support as fixed for CVE-2026-52923 in RHSA-2026:52764.
Red Hat lists Red Hat Enterprise Linux 8 kernel and kernel-rt packages as fixed for CVE-2026-52923 in advisories RHSA-2026:49851 and RHSA-2026:49857.
Red Hat lists Red Hat Enterprise Linux 10.0 Extended Update Support as fixed for CVE-2025-40026 in RHSA-2026:49030.
Red Hat lists Red Hat Enterprise Linux 9 as fixed for CVE-2026-52923 in advisory RHSA-2026:49212.
Red Hat states CVE-2025-40026 was addressed for RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service in RHSA-2026:47869.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
20 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important RHEL kernel updates addressing multiple Linux kernel flaws, including **CVE-2022-0492**, in which abuse of the cgroups v1 `release_agent` feature can enable local privilege escalation and bypass namespace isolation, creating a container-escape path. The upstream fix is tracked in commit `24f6008564183aa120d07c03d9289519c2fe02af`; related kernel issues include **CVE-2022-0847 (Dirty Pipe)**, file-descriptor handling defects, missing TLB flushing, usercopy use-after-free conditions, kernel memory read/write flaws, and TIPC denial of service. Affected updates include RHEL 8 kernel `4.18.0-348.20.1.el8_5` across x86_64, ARM64, IBM Z, and Power LE variants, as well as `kernel-rt` packages for RHEL 8.2 Real Time Telecommunications and NFV Telecommunications Update Service on x86_64. Organizations should apply the applicable updated kernel packages and reboot hosts to activate the fixes. Red Hat assessed OpenShift Container Platform clusters with SELinux enabled by default as protected against the CVE-2022-0492 container-escape and privilege-escalation path.
Aug 27, 2026
Red Hat released updates for **Red Hat Enterprise Linux 8** to fix `CVE-2021-46939`, a moderate-severity Linux kernel tracing flaw that can recursively acquire a spin lock when tracing is re-entered through the function graph tracer. A local attacker or user able to trigger the affected tracing conditions could cause a system deadlock and denial of service, including during suspend/resume testing. Red Hat rated the issue CVSS 5.5; RHEL 9 is not affected, while RHEL 6 and 7 are outside the affected support scope. Red Hat also issued **RHSA-2024:5439** for OpenShift Container Platform 4.15, delivering version 4.15.28 with updated container images and packages. The release remediates the Linux kernel route-management use-after-free vulnerability `CVE-2024-36971`, Go `net/http` memory-exhaustion flaw `CVE-2023-45290`, and Go `net/netip` IPv4-mapped IPv6 address-handling issue `CVE-2024-24790`; it also updates Kubernetes to 1.28.12. OpenShift 4.15 customers on x86_64, s390x, ppc64le, and aarch64 should upgrade through their supported release channel or the OpenShift web console.
Aug 26, 2026
Red Hat released Important-rated Linux kernel updates for **RHEL 8** and **RHEL 9**, including RHEL 8.6 Extended Update Support, addressing numerous memory-safety, privilege-escalation, denial-of-service, and speculative-execution vulnerabilities. The updates cover flaws such as `CVE-2024-1086`, an `nf_tables` use-after-free vulnerability; `CVE-2023-6546`, a GSM multiplexing race condition that can enable privilege escalation; net/sched classifier issues `CVE-2023-4128`, `CVE-2023-4206`, `CVE-2023-4207`, and `CVE-2023-4208`; and Intel Gather Data Sampling (`CVE-2022-40982`). The fixes also address `CVE-2023-4155`, a KVM double-fetch race affecting multi-vCPU AMD SEV-ES and SEV-SNP guests that could recursively invoke the VMGEXIT handler and exhaust kernel stack space. Red Hat noted that default `CONFIG_VMAP_STACK` protections mitigate the theoretical guest-to-host escape scenario on RHEL 8 and 9. Separate vmwgfx use-after-free flaws, `CVE-2022-38457` and `CVE-2022-40133`, could allow a local user with DRM-device access to crash affected systems. Organizations should install the applicable kernel packages across supported architectures and reboot hosts to activate the fixes.
Aug 26, 2026