Loading story…
Red Hat disclosed CVE-2026-23243, a Linux kernel flaw in the RDMA umad (User Mode Access Device) component that can let a local user trigger an integer underflow and out-of-bounds memory write. The bug stems from mismatched MAD and RMPP header size calculations in the umad write path, leading to kernel memory corruption during send MAD allocation. Red Hat rated the issue moderate severity with a CVSS v3 score of 7.3, warning that successful exploitation can crash systems and may also cause limited information disclosure and data integrity problems. As a mitigation, Red Hat advised preventing the ib_umad kernel module from loading where possible.
Red Hat shipped kernel security updates for multiple supported product lines to address the flaw alongside other kernel vulnerabilities, including RHEL 9.0, RHEL 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On, and RHEL 7 Extended Lifecycle Support. The advisories include RHSA-2026:13936, RHSA-2026:26570, and RHSA-2026:27729, with the RHEL 7 advisory rated Critical and covering multiple architectures such as x86_64, aarch64, ppc64le, and s390x. Red Hat said affected systems must be rebooted after applying the updated kernel packages for the fixes to take effect.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:27729 for Red Hat Enterprise Linux 7 Extended Lifecycle Support, providing updated kernel packages that fix CVE-2026-23243 along with five other vulnerabilities.
Red Hat issued RHSA-2026:26570 for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and 8.6 Extended Update Support Long-Life Add-On, including a kernel update that fixes CVE-2026-23243 among seven vulnerabilities.
Red Hat released a fix for CVE-2026-23243 for the Red Hat Enterprise Linux 10 kernel in advisory RHSA-2026:18134.
Red Hat released a fix for CVE-2026-23243 in the Red Hat Enterprise Linux 10.0 Extended Update Support kernel through advisory RHSA-2026:15883.
Red Hat issued RHSA-2026:13936 for Red Hat Enterprise Linux 9.0 offerings, including Update Services for SAP Solutions, and included a kernel update that fixes CVE-2026-23243 among multiple vulnerabilities.
Red Hat published CVE-2026-23243, describing a Linux kernel RDMA umad flaw in which an integer underflow can lead to an out-of-bounds memory write, causing denial of service and possible memory corruption impacts.
Red Hat released a fix for CVE-2026-23243 in the Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt package through advisory RHSA-2026:41236.
Red Hat released a fix for CVE-2026-23243 in the Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support kernel through advisory RHSA-2026:26535.
Red Hat released fixes for CVE-2026-23243 for Red Hat Enterprise Linux 8 kernel and kernel-rt packages via advisories RHSA-2026:21706 and RHSA-2026:21745.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories for the Linux kernel in **Red Hat Enterprise Linux 9.6** channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to **reboot systems after installation**. The newer advisory, **RHSA-2026:34094**, updates the kernel to `5.14.0-570.125.1.el9_6` across `x86_64`, `aarch64`, `ppc64le`, and `s390x`, and addresses **18 CVEs** spanning subsystems such as **netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP,** and process exit handling. An earlier advisory, **RHSA-2026:14339**, also targeted RHEL 9.6 kernel packages and listed impacts including **denial of service, memory corruption, privilege escalation,** and **use-after-free** flaws in components including **nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead,** and **CAN raw**. One of the patched issues, **CVE-2025-68741**, affects the Linux kernel's **qla2xxx SCSI driver** and stems from improper freeing of a `purex` item in `qla2xxx_process_purls_iocb()`. Red Hat and Bugzilla records say the flaw occurs when memory obtained from `qla24xx_alloc_purex_item()` is incorrectly released with `kfree()` instead of `qla24xx_free_purex_item()`, creating a **CWE-763** invalid pointer release condition that can cause **memory corruption**. Red Hat rated the issue **Moderate** for its products, noted that fixes were shipped across multiple **RHEL 8, 9, and 10** kernel packages, and said **RHEL 6** is not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026
Red Hat released kernel updates addressing **CVE-2025-38211**, a use-after-free vulnerability in the Linux kernel's RDMA iWARP Connection Manager (`RDMA/iwcm`). The flaw can occur when an event-handler work item drops the final reference to a `cm_id` while the workqueue can still access the associated work object; it was reproducible through the `blktests` `nvme/061` test using RDMA transport and the `siw` driver. The fix moves final `cm_id` reference handling into the connection-manager destruction context, preventing work objects from being freed prematurely. Red Hat included the fix in the Moderate-severity RHEL 8 advisory **RHSA-2025:15008**, providing kernel `4.18.0-553.72.1.el8_10` for x86_64, aarch64, ppc64le, and s390x systems, including selected Extended Life Cycle deployments; administrators should install the updated packages and reboot. Red Hat also issued related kernel security updates across RHEL product streams, including RHEL 10 packages that remediate multiple kernel flaws.
Aug 26, 2026