Loading story…
Red Hat disclosed and remediated CVE-2025-10263, an Important Linux kernel flaw affecting multiple Arm processor families, including Cortex, Neoverse, and C1 lines. The bug stems from a race condition in TLBI operations during memory permission changes and can let a low-privileged local attacker write to memory owned by a higher exception level, leading to kernel privilege escalation, information disclosure, or even guest-to-hypervisor escape. Red Hat scored the issue CVSS 8.4 and linked it to CWE-266.
Fixes were rolled out across a broad set of Red Hat products, including RHEL 8, 9, and 10 kernel packages and OpenShift Container Platform 4.22.6. Advisories such as RHSA-2026:51746 for RHEL 9.4 SAP-related variants and RHSA-2026:55445 for RHEL 10.0 Extended Update Support included CVE-2025-10263 alongside other kernel vulnerabilities, while RHSA-2026:40764 delivered OpenShift updates covering the same issue. Red Hat said affected systems should be updated promptly and rebooted after applying the new kernel packages.
Get the actors, campaigns, and ATT&CK mapping behind it.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat last modified its CVE-2025-10263 page, updating the public vulnerability record and fix status information.
Red Hat marked RHEL 10 kernel packages as fixed for CVE-2025-10263 in advisory RHSA-2026:34911.
Red Hat recorded the vulnerability description for CVE-2025-10263 in OSIDB/Bzimport, tracking the issue as an ARM processor flaw that may allow writes to higher exception level resources.
Red Hat published its CVE entry for CVE-2025-10263, describing an Important ARM/Linux kernel flaw caused by a TLBI race condition that can enable privilege escalation or guest-to-hypervisor escape.
Red Hat published RHSA-2026:55445, an Important kernel advisory for RHEL 10.0 Extended Update Support that fixes CVE-2025-10263 along with 10 other CVEs.
Red Hat marked RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service kernel packages as fixed in RHSA-2026:52649.
Red Hat published RHSA-2026:51746, an Important kernel advisory for RHEL 9.4 Update Services for SAP Solutions and related variants that fixes CVE-2025-10263 among other vulnerabilities.
Red Hat marked RHEL 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages as fixed in RHSA-2026:49033.
Red Hat marked RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages as fixed in RHSA-2026:47248.
Red Hat released OpenShift Container Platform 4.22.6 as an Important security update that includes a fix for CVE-2025-10263 along with several other kernel vulnerabilities.
Red Hat marked both RHEL 8 kernel-rt and standard kernel packages as fixed for CVE-2025-10263 in advisories RHSA-2026:36348 and RHSA-2026:36349.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026
Red Hat released Important RHEL kernel updates addressing multiple Linux kernel flaws, including **CVE-2022-0492**, in which abuse of the cgroups v1 `release_agent` feature can enable local privilege escalation and bypass namespace isolation, creating a container-escape path. The upstream fix is tracked in commit `24f6008564183aa120d07c03d9289519c2fe02af`; related kernel issues include **CVE-2022-0847 (Dirty Pipe)**, file-descriptor handling defects, missing TLB flushing, usercopy use-after-free conditions, kernel memory read/write flaws, and TIPC denial of service. Affected updates include RHEL 8 kernel `4.18.0-348.20.1.el8_5` across x86_64, ARM64, IBM Z, and Power LE variants, as well as `kernel-rt` packages for RHEL 8.2 Real Time Telecommunications and NFV Telecommunications Update Service on x86_64. Organizations should apply the applicable updated kernel packages and reboot hosts to activate the fixes. Red Hat assessed OpenShift Container Platform clusters with SELinux enabled by default as protected against the CVE-2022-0492 container-escape and privilege-escalation path.
Aug 27, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026