Loading story…
Red Hat released multiple kernel security advisories across RHEL 8, 9, and 10 product streams to remediate a set of Linux kernel vulnerabilities affecting core subsystems including CAN raw sockets, RDMA/umad, and the qla2xxx SCSI driver. The updates span standard, real-time, Extended Update Support, Extended Life Cycle, SAP, Telecommunications, and mission-critical channels, with advisories including RHSA-2026:13932, RHSA-2026:18134, RHSA-2026:19521, RHSA-2026:19875, RHSA-2026:20130, and RHSA-2026:27353. Red Hat rated several of the releases Important and said affected systems must be rebooted after installation for the fixes to take effect.
Among the patched issues, CVE-2026-31532 fixes a use-after-free in net/can/raw.c where raw_rcv() could access freed ro->uniq memory during deferred receiver deletion, while CVE-2026-23243 addresses an RDMA umad flaw in ib_umad_write() that could turn a negative data_len into memory corruption through an out-of-bounds memset. Red Hat advisories also include CVE-2025-71238, a double-free bug in qla2xxx BSG request handling that can crash the kernel and may enable privilege escalation, alongside other kernel flaws such as local privilege escalation, denial of service, and unauthorized file reads. Upstream Linux kernel guidance for the CAN issue points administrators to updated stable kernel releases rather than cherry-picking individual commits.
See real exploitation activity before you spend the cycle.
21 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:27353, an Important kernel security advisory for Red Hat Enterprise Linux 8 that delivered updated kernel packages and fixed eight CVEs including CVE-2026-31419, CVE-2026-31488, CVE-2026-43056, CVE-2026-43279, CVE-2026-46331, CVE-2026-46090, CVE-2026-46145, and CVE-2026-46135.
Red Hat Bugzilla documented CVE-2026-31532, describing the CAN raw socket use-after-free and the fix that moved freeing ro->uniq into a socket destructor.
Red Hat Bugzilla documented CVE-2026-23243, describing the RDMA/umad flaw and the fix to reject negative data_len in ib_umad_write.
Red Hat issued RHSA-2026:13932, an Important kernel security update for RHEL 9.4 Extended Update Support that included fixes for CVE-2025-71238 and CVE-2026-31532 among other kernel flaws.
The Linux kernel CVE team published an announcement for CVE-2026-31532, a CAN raw socket use-after-free in raw_rcv(), and noted fixes in kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Red Hat issued RHSA-2026:6954, a Moderate kernel security update for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The advisory delivered kernel 4.18.0-477.135.1.el8_8 and fixed seven Linux kernel vulnerabilities including CVE-2025-71238, CVE-2026-23001, and CVE-2026-23209.
An upstream advisory at lore.kernel.org identified the Linux kernel RDMA/umad negative data_len flaw as CVE-2026-23243.
Red Hat issued RHSA-2026:4011, a Moderate Linux kernel security update for RHEL 9.6 Extended Update Support and related update-service channels. It delivered kernel 5.14.0-570.96.1.el9_6 and fixed seven vulnerabilities, including CVE-2024-56603, CVE-2025-22056, CVE-2025-38024, CVE-2025-38129, and CVE-2025-38141.
An upstream advisory at lore.kernel.org identified the Linux kernel qla2xxx double-free issue as CVE-2025-71238.
Red Hat issued RHSA-2026:3268, an Important kernel security update for multiple Red Hat Enterprise Linux 8.6 service variants including AMCS, AUS, SAP, TUS, and Extended Life Cycle Long Life. The advisory delivered kernel version 4.18.0-372.181.1.el8_6 and fixed eight Linux kernel vulnerabilities including CVE-2025-38022, CVE-2025-40271, CVE-2023-53821, and CVE-2026-23074.
Red Hat issued RHSA-2026:1662, a Moderate kernel security update for Red Hat Enterprise Linux 8 that provided updated kernel packages fixing multiple Linux kernel vulnerabilities including CVE-2022-50865, CVE-2024-26766, and several 2025 CVEs. The advisory applied across RHEL 8 architectures and Extended Life Cycle 8.10 variants.
Red Hat listed CVE-2025-21999 as fixed for the Red Hat Enterprise Linux 10 kernel in advisory RHSA-2025:9348.
Red Hat listed CVE-2025-21999 as fixed for the Red Hat Enterprise Linux 9 kernel in advisory RHSA-2025:9080.
Red Hat published its CVE entry for CVE-2025-21999, describing a Linux kernel use-after-free in proc_get_inode() caused by a race between module removal and /proc inode instantiation.
Red Hat documented CVE-2024-56603, a CAN af_can can_create() error-path flaw that can leave a dangling socket pointer and cause a use-after-free. Red Hat shipped fixes for RHEL 9, RHEL 9.6 EUS, RHEL 10, and RHEL 10.0 EUS through listed RHSA advisories.
Red Hat listed CVE-2025-21999 as fixed for the Red Hat Enterprise Linux 9.4 Extended Update Support kernel in advisory RHSA-2026:21209.
Red Hat listed CVE-2025-21999 as fixed for the Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions kernel in advisory RHSA-2026:20593.
Red Hat issued RHSA-2026:20130, an Important kernel security update for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On that fixed CVE-2026-31532.
Red Hat issued RHSA-2026:19875, an Important kernel-rt security update for RHEL 9.2 Update Services for SAP Solutions that fixed CVE-2026-23243, CVE-2026-31532, and CVE-2025-21999 among other issues.
Red Hat issued RHSA-2026:19521, an Important kernel security update for RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service that fixed CVE-2026-23243 and CVE-2026-31532 among other flaws.
Red Hat issued RHSA-2026:18134, a Moderate kernel security update for RHEL 10 that included a fix for CVE-2026-23243 along with numerous other Linux kernel vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
17 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** kernel advisories across RHEL 8, 9, and 10 to address Linux kernel flaws including `CVE-2025-39766` in `net/sched` and `CVE-2025-68741` in the `qla2xxx` SCSI driver. Advisories `RHSA-2026:8921` and `RHSA-2026:9264` patched both issues for broad RHEL 9 and RHEL 10 product lines, while `RHSA-2026:9131`, `RHSA-2026:9135`, and `RHSA-2026:10996` included fixes for `CVE-2025-68741` alongside other kernel bugs in standard, real-time, and extended support channels. Red Hat said affected systems should be rebooted after applying the updated kernel packages. `CVE-2025-39766` stems from the Linux traffic-control scheduler, where `cake_enqueue()` could return `NET_XMIT_SUCCESS` after dropping packets past `buffer_limit`, allowing `htb_enqueue()` to activate an empty child qdisc and trigger a kernel warning; the fix changes the return value to `NET_XMIT_CN`. `CVE-2025-68741` affects `drivers/scsi/qla2xxx/qla_nvme.c`, where an error path improperly frees a `purex` item with `kfree()` instead of `qla24xx_free_purex_item()`, creating a risk of memory corruption. Additional Red Hat kernel advisories in the same period also bundled other flaws such as race conditions, heap overflows, use-after-free bugs, and privilege-escalation issues across legacy, SAP, real-time, and extended lifecycle offerings.
Aug 25, 2026
Red Hat released multiple **Important** security advisories for the Linux kernel in **Red Hat Enterprise Linux 9.6** channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to **reboot systems after installation**. The newer advisory, **RHSA-2026:34094**, updates the kernel to `5.14.0-570.125.1.el9_6` across `x86_64`, `aarch64`, `ppc64le`, and `s390x`, and addresses **18 CVEs** spanning subsystems such as **netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP,** and process exit handling. An earlier advisory, **RHSA-2026:14339**, also targeted RHEL 9.6 kernel packages and listed impacts including **denial of service, memory corruption, privilege escalation,** and **use-after-free** flaws in components including **nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead,** and **CAN raw**. One of the patched issues, **CVE-2025-68741**, affects the Linux kernel's **qla2xxx SCSI driver** and stems from improper freeing of a `purex` item in `qla2xxx_process_purls_iocb()`. Red Hat and Bugzilla records say the flaw occurs when memory obtained from `qla24xx_alloc_purex_item()` is incorrectly released with `kfree()` instead of `qla24xx_free_purex_item()`, creating a **CWE-763** invalid pointer release condition that can cause **memory corruption**. Red Hat rated the issue **Moderate** for its products, noted that fixes were shipped across multiple **RHEL 8, 9, and 10** kernel packages, and said **RHEL 6** is not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released **RHSA-2026:21557**, an Important security update for the Linux kernel in **Red Hat Enterprise Linux 10** and related channels, addressing **18 vulnerabilities** across subsystems including CAN J1939, IMA, memory management, netfilter, conntrack, `io_uring`, Bluetooth, HID, Wi-Fi, XFS, and `dpaa2-switch`. The advisory applies to multiple RHEL 10 variants on `x86_64`, `ARM64`, IBM z Systems, and Power little endian, including Extended Update Support and Extended Life Cycle offerings, and Red Hat said affected systems must be **rebooted** after patching for the fixes to take effect. Among the flaws covered were **CVE-2026-31684**, a network scheduler bug triggered by specially crafted packets with nested VLAN headers that can cause an out-of-bounds read and system crash, and **CVE-2026-43027**, a netfilter `nf_conntrack_helper` cleanup flaw that can lead to a use-after-free condition, enabling denial of service and potentially privilege escalation. Red Hat rated both issues **moderate severity** with CVSS v3 scores of **7.1**, and said fixes were issued across multiple RHEL kernel package streams, including RHEL 7, 8, and 10 for the VLAN-related flaw and additional errata for the conntrack issue.
Aug 25, 2026