Loading story…
Red Hat disclosed CVE-2026-64561, a moderate-severity flaw in the Linux kernel's KVM subsystem caused by improper validation of MMU page roots after those pages are made available. The bug can cause KVM to map memory into an invalid root, allowing child shadow pages to inherit an invalid state and potentially leading to system instability or denial of service in virtualized environments. Red Hat scored the issue at CVSS 7.0, while cve.org lists 8.8, and classified it as CWE-825 Expired Pointer Dereference; Red Hat said multiple Red Hat Enterprise Linux kernel packages were fixed through July 2026 errata, while RHEL 6 was not affected because the vulnerable code is absent.
In a separate kernel advisory, RHSA-2026:49030, Red Hat released updated RHEL 10.0 kernel packages to fix two additional KVM-related vulnerabilities, CVE-2025-40026 and CVE-2026-63807, across standard, Extended Update Support, and 4-year update channels. The advisory lists fixed packages as kernel-6.12.0-55.94.1.el10_0 for x86_64, s390x, ppc64le, and aarch64, including associated CodeReady Linux Builder repositories, and noted that affected systems must be rebooted after installation for the protections to take effect.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat published security advisory RHSA-2026:49030 on July 31, 2026, making updated RHEL 10.0 kernel packages available and requiring a reboot after installation. The advisory explicitly describes fixes for CVE-2025-40026 and CVE-2026-63807, and also lists CVE-2026-64561 in its CVE section.
Red Hat lists CVE-2026-64561 as fixed in several kernel advisories released on July 24, 2026, covering RHEL 8 kernel, RHEL 8 kernel-rt, RHEL 9 kernel, and RHEL 10 kernel. The flaw affects KVM in the Linux kernel and can cause instability or denial of service in virtualized environments.
Red Hat last modified the CVE-2026-64561 record on August 13, 2026. The record notes affected and fixed RHEL kernel packages and states that RHEL 6 is not affected because the vulnerable code is not present.
Red Hat published its CVE record for CVE-2026-64561 on August 4, 2026, describing a KVM flaw caused by improper validation of MMU page roots after those pages are made available. Red Hat rated the issue Moderate and assigned it a CVSS v3 score of 7.0.
Red Hat also lists CVE-2026-64561 as fixed on July 31, 2026, in RHSA-2026:48386 for RHEL 9.4 Update Services for SAP Solutions and RHSA-2026:49031 for RHEL 9.6 Extended Update Support. The same date includes the RHEL 10.0 Extended Update Support fix tracked in RHSA-2026:49030.
On July 29, 2026, Red Hat lists CVE-2026-64561 as fixed in RHSA-2026:47869 for RHEL 8.8 Telecommunications Update Service and RHEL 8.8 Update Services for SAP Solutions kernel packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity Linux kernel security updates for **RHEL 9** and **RHEL 10**, addressing a broad set of memory-safety, denial-of-service, information-disclosure, and privilege-escalation risks across subsystems including BPF, KVM, netfilter, MPTCP, SMB, RDMA, NFS, and device drivers. The fixes are delivered through **RHSA-2025:20518** for RHEL 9 and **RHSA-2026:18134** for RHEL 10, covering supported x86_64, aarch64, s390x, and ppc64le variants, including applicable extended-support offerings. Among the remediated flaws, **CVE-2025-21839** affects KVM/x86 handling of the guest DR6 debug register: under certain fast-path VM-exit conditions, particularly in nested VMX deployments, KVM could restore a stale DR6 value and overwrite the guest's current value. **CVE-2024-53216** affects the NFS server (`nfsd`), where cache objects could be released while RCU readers still accessed them, creating a slab use-after-free condition; the fix defers object release until after an RCU grace period. Red Hat requires affected systems to be rebooted after installing the updated kernel for protections to take effect.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released **RHSA-2026:21557**, an Important security update for the Linux kernel in **Red Hat Enterprise Linux 10** and related channels, addressing **18 vulnerabilities** across subsystems including CAN J1939, IMA, memory management, netfilter, conntrack, `io_uring`, Bluetooth, HID, Wi-Fi, XFS, and `dpaa2-switch`. The advisory applies to multiple RHEL 10 variants on `x86_64`, `ARM64`, IBM z Systems, and Power little endian, including Extended Update Support and Extended Life Cycle offerings, and Red Hat said affected systems must be **rebooted** after patching for the fixes to take effect. Among the flaws covered were **CVE-2026-31684**, a network scheduler bug triggered by specially crafted packets with nested VLAN headers that can cause an out-of-bounds read and system crash, and **CVE-2026-43027**, a netfilter `nf_conntrack_helper` cleanup flaw that can lead to a use-after-free condition, enabling denial of service and potentially privilege escalation. Red Hat rated both issues **moderate severity** with CVSS v3 scores of **7.1**, and said fixes were issued across multiple RHEL kernel package streams, including RHEL 7, 8, and 10 for the VLAN-related flaw and additional errata for the conntrack issue.
Aug 25, 2026