Loading story…
Red Hat released Important kernel and kernel-rt updates across multiple Red Hat Enterprise Linux streams to fix CVE-2025-68183, a Linux kernel flaw in the Integrity Measurement Architecture (IMA) that can clear the IMA_DIGSIG flag when non-IMA extended attributes are changed. The bug can cause a valid file signature stored in security.ima to be replaced with an IMA hash after changes to attributes such as security.selinux, security.evm, or ACLs, particularly on systems using IMA and EVM in fix mode and workflows such as rpm-plugin-ima. Red Hat rates the issue Moderate with a CVSS v3 score of 7.1 and maps it to CWE-354.
The fix was shipped through multiple advisories covering RHEL 8, RHEL 8 kernel-rt, RHEL 9.2, RHEL 9.4, RHEL 9.6 EUS, RHEL 9.2 kernel-rt, and RHEL 10, alongside other kernel vulnerability remediations. Notable package versions include 5.14.0-284.179.1.el9_2, 5.14.0-427.136.1.el9_4, 5.14.0-570.127.1.el9_6, and 5.14.0-284.179.1.rt14.464.el9_2; Red Hat said affected systems must be rebooted after applying the updates for the fixes to take effect.
See real exploitation activity before you spend the cycle.
12 events from the most recent confirmed update back to the earliest known activity.
Red Hat released Important advisory RHSA-2026:21745 for Red Hat Enterprise Linux 8 kernel-rt packages, fixing CVE-2025-68183 along with other kernel flaws. The advisory covered Real Time and related RHEL 8 offerings and required a reboot.
Red Hat issued Important advisory RHSA-2026:21706 for Red Hat Enterprise Linux 8 kernel packages and included a fix for CVE-2025-68183. The update applied across multiple RHEL 8 architectures and variants and required a reboot.
Red Hat released Important advisory RHSA-2026:21557 for Red Hat Enterprise Linux 10 kernel packages, including a fix for CVE-2025-68183. The update covered multiple RHEL 10 variants and required a reboot after installation.
An upstream advisory for CVE-2025-68183 was published on the linux-cve-announce list. The issue was described as an IMA flaw where non-IMA xattr changes could clear the IMA_DIGSIG flag and lead to a signature being replaced with a hash.
Red Hat's CVE entry states that RHSA-2026:47633 fixed CVE-2025-68183 for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and 8.4 Extended Update Support Long-Life Add-On kernel packages. The same date is also noted as the last modification date of Red Hat's CVE page.
Red Hat's CVE entry states that RHSA-2026:40760 fixed CVE-2025-68183 for Red Hat Enterprise Linux 8.8 Telecommunications Update Service and 8.8 Update Services for SAP Solutions kernel packages. This expanded coverage to additional RHEL 8.8 channels.
Red Hat's CVE entry states that CVE-2025-68183 was fixed for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On in RHSA-2026:40068. This added remediation for additional RHEL 8.6 support streams.
Red Hat's CVE entry states that Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages were fixed for CVE-2025-68183 in RHSA-2026:39371. This extended the remediation to the RHEL 10.0 EUS stream.
Red Hat released Important advisory RHSA-2026:38902 for Red Hat Enterprise Linux 9.6 Extended Update Support and related channels, fixing CVE-2025-68183 among 11 kernel CVEs. Updated kernel packages version 5.14.0-570.127.1.el9_6 were provided and a reboot was required.
Red Hat issued Important advisory RHSA-2026:36767 for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related variants. The kernel update fixed CVE-2025-68183 and other vulnerabilities and required a reboot.
Red Hat released Important advisory RHSA-2026:36073 for Red Hat Enterprise Linux 9.2 kernel packages, including a fix for CVE-2025-68183. The advisory covered SAP, AUS, 4-year update, and Extended Life Cycle variants across several architectures.
Red Hat issued Important advisory RHSA-2026:35904 for kernel-rt on Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle. The update fixed CVE-2025-68183 and required systems to be rebooted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel security updates and live patches for multiple Red Hat Enterprise Linux versions to remediate several Linux kernel vulnerabilities, including `CVE-2026-43499`, `CVE-2026-46116`, and `CVE-2026-46227`. The updates span standard kernel packages for **RHEL 7 ELS** and **RHEL 9**, as well as **kpatch** live-patch modules for **RHEL 9** and **RHEL 10**, allowing some systems to receive fixes without a reboot. The advisories also bundle additional kernel issues such as `CVE-2026-45984`, `CVE-2026-53166`, `CVE-2026-64531`, and `CVE-2026-31684`, affecting a broad set of x86_64, ppc64le, s390x, and aarch64 product variants, including SAP, EUS, and ELS offerings. The patched flaws include an **rtmutex** bug in `remove_waiter()` that could manipulate the wrong task state during futex proxy locking, an **xfrm** state-deletion bug that triggered slab use-after-free and out-of-bounds writes under repeated list removal, and an **SCTP** `SCTP_SENDALL` iterator flaw that could leave a stale association pointer after the socket lock was dropped, creating use-after-free or type-confusion conditions. Red Hat said fixes were propagated across numerous RHEL 8, 9, and 10 streams and support channels, with standard kernel packages requiring a reboot and `kpatch` updates available for selected RHEL 9 and RHEL 10 kernels.
Aug 25, 2026
Red Hat issued **Important** kernel security updates for **CVE-2025-37914**, a Linux traffic-control flaw in the `net_sched` Enhanced Transmission Selection (ETS) queuing discipline. When ETS uses a `netem` child qdisc, a reentrant enqueue callback can add the same classifier to ETS's active list twice, potentially causing memory corruption. The upstream correction prevents duplicate insertion by confirming both that the queue length is zero and that the class is not already active. The fix was delivered through RHEL 8, 9, and 10 advisories, including RHEL 10 advisory **RHSA-2025:14510**, which also addresses `CVE-2025-38200` in the `i40e` driver and `CVE-2025-38417` in the `ice` driver across supported architectures. Red Hat also released updated Real Time Linux Kernel packages for RHEL 9.2 SAP Solutions and Extended Life Cycle systems under **RHSA-2025:17735**; affected organizations should install `kernel-rt-5.14.0-284.142.1.rt14.427.el9_2` where applicable and reboot after updating.
Aug 26, 2026
Red Hat released **Important** security updates for the Linux kernel across **RHEL 8, RHEL 9, and RHEL 10**, including `kernel-rt` for Real Time deployments, fixing vulnerabilities in core subsystems such as **SMB/CIFS client code, iSCSI target handling, SMC, `sched/psi`, `memfd`, UDF, netfilter, POSIX CPU timers, and AMD GPU drivers**. The advisories cover **nine CVEs in RHEL 8**, **26 CVEs in RHEL 9**, and **24 CVEs in RHEL 10**, with affected offerings spanning standard, Extended Life Cycle, Extended Update Support, SAP, NFV, and CodeReady Linux Builder channels across **x86_64, s390x, ppc64le, and aarch64**. Red Hat said systems should be **rebooted after applying the updates** and reiterated that kernel errata should be treated as security-relevant because of the kernel’s central role. Among the patched flaws, Red Hat detailed **`CVE-2026-53143`**, a **buffer overflow** in the `drm/amdkfd` driver on **GFX11** that could leak or corrupt adjacent GTT memory during CRIU checkpoint and restore operations because SDMA queues used compute-specific handlers with the wrong MQD size. The company also fixed **`CVE-2026-63952`** in **`memfd`**, where writable mappings could persist even when `SEAL_EXEC` implicitly applied `SEAL_WRITE`, weakening the expected write-seal guarantees and undermining **W^X** protections. The RHEL 9 advisory also includes non-security fixes, including a regression in `5.14.0-687.5.1.el9_8` that broke Wi-Fi when **FIPS** was enabled.
Sep 5, 2026