Loading story…
Red Hat released kernel security updates across multiple RHEL 8 product streams to fix CVE-2026-43163, a Linux kernel flaw in the md/bitmap component caused by a use-after-free race during array resize operations. The bug occurs when bitmap_daemon_work() and __bitmap_resize() run concurrently, allowing bitmap->storage.filemap pages to be accessed after they have been freed by md_bitmap_file_unmap(), which can trigger a General Protection Fault and crash the system. Red Hat classifies the issue as moderate severity with a CVSS v3 score of 4.7 and maps it to CWE-825: Expired Pointer Dereference.
The flaw was addressed by holding mddev->bitmap_info.mutex during bitmap updates to prevent the race, and Red Hat shipped the fix in several advisories, including RHSA-2026:26563 for RHEL 8.8 SAP Solutions and Telecommunications Update Service and RHSA-2026:53989 for RHEL 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On. The later advisory bundled the md/bitmap fix with other kernel issues such as a double free in xen/privcmd, SMB client memory errors, a Xen privilege-escalation flaw on AMD Zen 2 processors, and a dm log out-of-bounds write. Red Hat said affected systems should be rebooted after applying the updated kernel packages.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2026:53989, an Important kernel security update for RHEL 8.6 AM-CUS and EUS Long-Life Add-On that fixes CVE-2026-43163 and four additional kernel vulnerabilities.
Red Hat published the customer portal page for CVE-2026-43163, listing a CVSS v3 score of 4.7 and summarizing the denial-of-service risk from the md/bitmap use-after-free race.
Red Hat released RHSA-2026:26563, an Important kernel security update for RHEL 8.8 SAP Solutions and Telecommunications Update Service that includes a fix for CVE-2026-43163 along with 17 other kernel vulnerabilities.
Red Hat's Bugzilla entry documented that CVE-2026-43163 stems from a race between bitmap_daemon_work() and __bitmap_resize(), and noted the fix of holding mddev->bitmap_info.mutex during bitmap updates.
Red Hat published its CVE record for CVE-2026-43163, classifying the Linux kernel md/bitmap flaw as a moderate-severity use-after-free race mapped to CWE-825.
An upstream advisory for CVE-2026-43163 was posted on lore.kernel.org describing an md/bitmap use-after-free race that can cause a general protection fault in write_page() during array resize operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026