Loading story…
Red Hat released multiple kernel security advisories for Red Hat Enterprise Linux 8 and RHEL 9.2 variants, including Update Services for SAP Solutions and Extended Life Cycle channels, to address a set of Linux kernel vulnerabilities affecting locking, virtualization, and networking code. The updates remediate five flaws in the RHEL 9.2 packages—CVE-2026-43027, CVE-2026-43499, CVE-2026-46113, CVE-2026-53166, and CVE-2026-53359—covering issues in netfilter, rtmutex, futex/requeue, and two KVM x86 shadow paging use-after-free conditions. A separate RHEL 8 advisory fixes eight kernel vulnerabilities spanning net/sched, IOMMU, ATM networking, rtmutex, futex, KVM x86 shadow paging, and netfilter ebtables.
One of the patched bugs, CVE-2026-53166, is a moderate-severity flaw in the futex requeue mechanism that can trigger a NULL pointer dereference and crash the kernel during a self-deadlock scenario, resulting in local denial of service. Red Hat grouped that issue with CVE-2026-43499 in its "GhostLock" bulletin, warning that the affected futex priority-inheritance code is built into standard RHEL kernels and that no runtime mitigation is available. The company urged customers to install the updated kernel packages and reboot affected systems for the fixes to take effect.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2026:40082 for Red Hat Enterprise Linux 9.2 kernel packages version 5.14.0-284.181.1.el9_2 across multiple architectures and lifecycle channels. The update addressed five vulnerabilities: CVE-2026-43027, CVE-2026-43499, CVE-2026-46113, CVE-2026-53166, and CVE-2026-53359.
Red Hat published Moderate advisory RHSA-2026:39983 for kernel-rt packages in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The update fixed five kernel vulnerabilities, including CVE-2026-43027, CVE-2026-43499, CVE-2026-46113, CVE-2026-53166, and CVE-2026-53359, and required a reboot.
Red Hat issued Important advisory RHSA-2026:39083 for Red Hat Enterprise Linux 8 kernel packages version 4.18.0-553.143.1.el8_10. The update fixed eight kernel vulnerabilities, including CVE-2026-53166, CVE-2026-43499, CVE-2026-46113, and CVE-2026-53359, and required a reboot after installation.
Red Hat last modified its CVE-2026-53166 page and recorded multiple product fix states, including NVIDIA for RHEL 10 fixed via RHSA-2026:37728. The updated entry also linked the issue to Bugzilla 2492805 and mitigation bulletin RHSB-2026-010.
Red Hat published security bulletin RHSB-2026-010 covering the locking-subsystem flaws CVE-2026-43499 and CVE-2026-53166 across RHEL 6 through 10 and kernel-dependent products. Red Hat said there was no runtime mitigation, that fixes were being expedited, and that customers should update to patched kernels and reboot when errata became available.
Red Hat published its CVE record for CVE-2026-53166, classifying the Linux kernel futex/requeue flaw as Moderate severity with a CVSS v3.1 score of 5.5. The entry states the bug can trigger a NULL pointer dereference and kernel crash, resulting in local denial of service.
The Linux kernel CVE team announced CVE-2026-53166, a futex/requeue NULL pointer dereference bug that can crash the kernel during a self-deadlock condition. The announcement described the root cause in remove_waiter() and identified fixed upstream kernel versions including 6.18.36 and 7.0.13.
Red Hat published its CVE record for CVE-2026-31532, describing a Moderate-severity use-after-free flaw in the Linux kernel CAN raw socket implementation that can let a local attacker crash the kernel. The entry assessed the likely impact as denial of service and recommended blacklisting the `can` kernel module as a mitigation when CAN functionality is not needed.
Red Hat published Moderate advisory RHSA-2026:3267 for Red Hat Enterprise Linux 9.2 kernel update streams, including SAP Solutions, AUS, 4-year updates, and Extended Life Cycle variants. The update provided new kernel packages fixing multiple vulnerabilities across components including xHCI, SCSI mpi3mr, Squashfs, USB parsing, VXLAN, SMB, Bluetooth, ALSA USB audio, ext4, and NFSv4/pNFS, and required a reboot after installation.
Red Hat published Important advisory RHSA-2026:0535 for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related AUS, 4-year update, and Extended Life Cycle variants. The kernel update fixed 11 vulnerabilities across subsystems including NFSD, SMB client, CAN J1939, Bluetooth, RDMA/rxe, SCSI SES, TLS, USB DWC3, and libceph, and required a reboot after installation.
An upstream Linux kernel advisory published in October 2025 disclosed CVE-2023-53539, an RDMA/rxe flaw caused by incomplete state saving in rxe_requester after failed packet transmission. The bug could corrupt retransmitted packets under heavy stress, and the patch restored the missing dma-related state.
Red Hat issued Important advisory RHSA-2025:10671 for RHEL 9.2 SAP Solutions, AUS, and Extended Life Cycle kernel update streams. Kernel version 5.14.0-284.124.1.el9_2 fixed CVE-2023-1652, CVE-2025-37738, CVE-2022-49846, and CVE-2022-50066; affected systems required a reboot after installation.
Rohit Keshri reported CVE-2023-1652, a medium-severity use-after-free in the Linux NFS server function nfsd4_ssc_setup_dul() that affects kernels through v6.2-rc4 and can cause denial of service. Upstream commit e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd fixed the issue, with kernel 6.2 RC5 identified as fixed.
Red Hat updated advisory RHSA-2026:39083 after its initial release. The advisory remained the vehicle for the RHEL 8 kernel security update fixing eight vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
14 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **kernel security advisories** for Red Hat Enterprise Linux 8, 9, and 10 channels to address several Linux kernel vulnerabilities, including **CVE-2026-23097**, **CVE-2026-23193**, **CVE-2026-31402**, **CVE-2026-31431**, and **CVE-2026-43077**. The flaws span a hugetlb folio migration deadlock that can trigger system hangs and denial of service, a use-after-free in iSCSI target code, a `qla2xxx` double-free that may enable denial of service or privilege escalation, a heap overflow in the NFSv4.0 LOCK replay cache, and a crypto `algif_aead` buffer-size validation issue that could lead to crashes, memory corruption, memory disclosure, or possible code execution in some contexts. The updates were published through advisories including **RHSA-2026:11313**, **RHSA-2026:13664**, **RHSA-2026:13681**, **RHSA-2026:13887**, and **RHSA-2026:14165**, covering product variants such as RHEL 8.4, 8.6, 8.8, 9.6, and 10.0 support channels. Red Hat rated several of the kernel updates as **Important** and noted that no acceptable mitigation was available for the hugetlb deadlock issue; affected systems require installation of the updated kernel packages and a **reboot** for protections to take effect.
Aug 25, 2026
Red Hat released **Important** security updates for the Linux kernel across **RHEL 8, RHEL 9, and RHEL 10**, including `kernel-rt` for Real Time deployments, fixing vulnerabilities in core subsystems such as **SMB/CIFS client code, iSCSI target handling, SMC, `sched/psi`, `memfd`, UDF, netfilter, POSIX CPU timers, and AMD GPU drivers**. The advisories cover **nine CVEs in RHEL 8**, **26 CVEs in RHEL 9**, and **24 CVEs in RHEL 10**, with affected offerings spanning standard, Extended Life Cycle, Extended Update Support, SAP, NFV, and CodeReady Linux Builder channels across **x86_64, s390x, ppc64le, and aarch64**. Red Hat said systems should be **rebooted after applying the updates** and reiterated that kernel errata should be treated as security-relevant because of the kernel’s central role. Among the patched flaws, Red Hat detailed **`CVE-2026-53143`**, a **buffer overflow** in the `drm/amdkfd` driver on **GFX11** that could leak or corrupt adjacent GTT memory during CRIU checkpoint and restore operations because SDMA queues used compute-specific handlers with the wrong MQD size. The company also fixed **`CVE-2026-63952`** in **`memfd`**, where writable mappings could persist even when `SEAL_EXEC` implicitly applied `SEAL_WRITE`, weakening the expected write-seal guarantees and undermining **W^X** protections. The RHEL 9 advisory also includes non-security fixes, including a regression in `5.14.0-687.5.1.el9_8` that broke Wi-Fi when **FIPS** was enabled.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026