Loading story…
Red Hat released Important Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are RHSA-2026:1142 for RHEL 8, RHSA-2026:1143 for RHEL 9, and RHSA-2026:1690 for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels.
Notable fixes include CVE-2025-38453, a use-after-free condition in io_uring msg_ring request handling; CVE-2025-40301, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and CVE-2025-38731, a double-free flaw in the DRM Xe driver's xe_vm_bind_ioctl path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued an Important kernel update for RHEL 10 and related EUS, ELS, four-year support, and CodeReady Linux Builder channels. It fixes 19 Linux kernel vulnerabilities, including CVE-2025-38453, CVE-2025-38731, and CVE-2025-40301; affected systems must be rebooted for the fixes to take effect.
Red Hat released an Important Linux kernel update for RHEL 9 that remediates eight flaws, including use-after-free, double-free, race-condition, memory-corruption, and out-of-bounds-write vulnerabilities. The advisory includes fixes for CVE-2025-38141, CVE-2025-38349, CVE-2025-38731, CVE-2025-40248, CVE-2025-40258, CVE-2025-40294, CVE-2025-68301, and CVE-2025-68305.
Red Hat issued an Important kernel security update for Red Hat Enterprise Linux 8, fixing CVE-2023-53673, CVE-2025-40154, CVE-2025-40248, and CVE-2025-40277. The update applies to supported RHEL 8 architectures and designated CodeReady Linux Builder and Extended Life Cycle repositories; systems require a reboot after installation.
Red Hat documented that RHSA-2026:1727 remediates CVE-2025-38453, an io_uring msg_ring use-after-free, and CVE-2025-40301, a Bluetooth HCI event-handling information-disclosure and denial-of-service flaw, for RHEL 10.0 Extended Update Support.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8.8 SAP and Telecommunications Update Services, RHEL 9 and 9.4 support channels, and RHEL 10 offerings. The advisories address memory-corruption, use-after-free, out-of-bounds read/write, integer-overflow, information-disclosure, and denial-of-service vulnerabilities that could cause service disruption or, in some cases, privilege escalation. Affected packages span x86_64, s390x, ppc64le, and aarch64 systems, including SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder channels. Notable fixes include MPTCP use-after-free flaw `CVE-2025-40133`, corrected in RHEL 10 through RHSA-2026:2282, and `CVE-2025-68811`, an `svcrdma` copy-offset defect that could cause `memcpy` operations outside the current page and was fixed across supported RHEL 9 and 10 releases. Other patched issues include `CVE-2025-68349`, `CVE-2026-22998`, and `CVE-2026-23074`; RHEL 8.8 customers should deploy kernel version `4.18.0-477.130.1.el8_8`. Red Hat requires systems to be rebooted after installation for the kernel fixes to take effect.
Aug 26, 2026