Loading story…
Red Hat released moderate-severity RHEL 8 kernel and real-time kernel updates addressing eight Linux kernel vulnerabilities across networking, IPv6, USB audio, vsock/vmci, ext4, NFSv4/pNFS, and NVMe/TCP components. The updates are delivered through RHSA-2026:2264 for standard RHEL 8 packages and RHSA-2026:2378 for RHEL for Real Time, Real Time for NFV, and applicable Extended Life Cycle streams.
Notable fixes include IPv6 and networking use-after-free risks tracked as CVE-2025-40135, CVE-2025-40158, and CVE-2025-40170, remediated by using RCU-protected access to destination-device data in paths including ip6_xmit(), ip6_output(), and sk_setup_caps(). The updates also address CVE-2025-39757 and CVE-2025-38729, where malformed USB Audio Class 3 descriptors from malicious USB audio firmware could cause out-of-bounds memory accesses. Organizations should apply the appropriate updated kernel packages and reboot affected systems for the fixes to take effect.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:2378, a Moderate-severity kernel-rt update for RHEL 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10. It fixes CVE-2025-40135, CVE-2025-40158, and CVE-2025-40170, and requires a reboot after installation.
Red Hat published RHSA-2026:2264, a Moderate-severity RHEL 8 kernel update that fixes CVE-2025-40135, CVE-2025-40158, and CVE-2025-40170 alongside five other kernel vulnerabilities. The update requires a system reboot for fixes to take effect.
An upstream advisory disclosed CVE-2025-40170, resolved by applying RCU-protected dst->dev access in sk_setup_caps(), sk_dst_gso_max_size(), and other IPv4 and IPv6 networking functions.
An upstream advisory disclosed CVE-2025-40158 in the Linux kernel IPv6 output path. Its fix uses RCU in ip6_output() and dst_dev_rcu(), and removes redundant RCU lock/unlock pairs from ip6_finish_output2().
An upstream advisory disclosed CVE-2025-40135 in the Linux kernel IPv6 networking code. The resolution changes ip6_xmit() to use RCU and dst_dev_rcu() to prevent a possible use-after-free condition.
Red Hat published RHSA-2025:18298, a Moderate-security RHEL 8 kernel-rt update for Real Time, Real Time for NFV, and RHEL 8.10 Extended Life Cycle systems. It fixes CVE-2025-39757 as well as CVE-2025-39751 in the ALSA HDA ca0132 driver and CVE-2023-53373 in crypto seqiv; affected systems require a reboot.
An upstream Linux CVE announcement disclosed CVE-2025-39757, in which insufficient UAC3 cluster-segment descriptor validation could allow malformed USB audio firmware to cause out-of-bounds memory access. The fix verifies descriptor sizes and declared lengths against allocated buffer bounds.
An upstream Linux CVE announcement disclosed CVE-2025-38729, involving insufficient validation of variable-length UAC3 power-domain descriptors that could permit out-of-bounds memory access from malicious USB audio firmware. The kernel fix validates the descriptors and their bLength values before processing.
Red Hat issued Important-rated RHSA-2025:13776 for RHEL 8.6 Extended Life Cycle Long Life, AUS, TUS, and SAP Update Services variants. The 4.18.0-372.157.1.el8_6 kernel update fixes 12 vulnerabilities, including CVE-2022-49788, CVE-2025-21727, CVE-2025-21928, and CVE-2025-38052; affected systems require a reboot.
An upstream Linux CVE announcement disclosed CVE-2024-57980, a double-free flaw in the uvcvideo driver's error path when uvc_status_init() frees dev->status after an int_urb allocation failure without clearing the pointer. The fix sets dev->status to NULL after freeing it, preventing uvc_status_cleanup() from freeing stale memory again.
CVE-2022-49788 affects the Linux VMware VMCI driver's datagram receive path, where uninitialized padding in a vmci_event_qp structure could be copied to userspace. Red Hat issued fixes through 2025 RHSA advisories for affected RHEL 7, 8, and 9 product variants; the upstream fix initializes the structure with memset().
CVE-2024-53197 was resolved in the Linux kernel after it was found that malicious Extigy or Mbox USB devices could report a bNumConfigurations value exceeding the allocation for dev->config, causing later out-of-bounds accesses such as in usb_destroy_configuration. Fedora included the fix in 6.11.11 stable kernel updates, and Red Hat issued fixes for multiple RHEL and OpenShift Container Platform support streams.
Red Hat addressed CVE-2025-39757 through advisories covering RHEL 7, 8, 9, and 10, including Extended Update Support, SAP, telecommunications, and mission-critical product streams.
Red Hat addressed CVE-2025-38729 through advisories for multiple RHEL 7, 8, and 9 support channels, including Extended Update Support, SAP Solutions, telecommunications, and mission-critical variants.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued kernel security updates for RHEL 7 Extended Lifecycle Support, RHEL 8, RHEL 9, and RHEL for Real Time 7, remediating vulnerabilities in USB, networking, storage, and scheduler components. The updates address **CVE-2022-50229**, a use-after-free in the ALSA BCD2000 driver's probe-error path; **CVE-2023-53125**, which could expose kernel memory through an oversized packet length in the SMSC75xx USB Ethernet driver; and **CVE-2025-38392**, an invalid locking-context flaw in the `idpf` network driver when MAC-filter capability is enabled. The RHEL 7 advisories also cover issues in USB audio, RAID10, Intel `i40e` networking, and the QFQ scheduler, while the RHEL 9 update includes fixes for the DWC3 USB gadget driver, mount type changes, and the s390 SCLP subsystem. RHEL 8 customers should install kernel version `4.18.0-553.75.1.el8_10`; RHEL for Real Time 7 customers should install `3.10.0-1160.140.1.rt56.1292.el7`. Administrators should deploy the applicable updated kernel packages across supported architectures and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026