Loading story…
Red Hat released multiple Important kernel security advisories for RHEL 8, RHEL 9, and RHEL 10, including standard kernel updates and kpatch live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the kpatch releases allow remediation without rebooting on supported kernels.
The fixes address recurring kernel issues including CVE-2026-43038 in IPv6 ICMP handling, CVE-2026-43125 in DLM length validation, CVE-2026-43329 in netfilter flowtable action checking, CVE-2026-46244 involving nft_inner IPv6 offset desynchronization, and CVE-2026-64530, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched CVE-2026-31692, a privilege-related flaw in rtnetlink where missing netlink_ns_capable() checks could let an unprivileged user in a user namespace create paired interfaces such as veth in arbitrary network namespaces, including init_net; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include CVE-2025-40237, CVE-2026-23110, CVE-2026-31641, CVE-2026-43116, CVE-2026-46099, CVE-2026-46150, CVE-2026-52973, CVE-2026-53059, CVE-2026-64561, and CVE-2026-64530.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:56225, an Important kpatch live patch advisory for Red Hat Enterprise Linux 9.6 Extended Update Support and related service variants. The update for kernel-5.14.0-570.17.1.el9_6 fixes CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, CVE-2026-46244, and CVE-2026-64530.
Red Hat issued RHSA-2026:56224, an Important kpatch live patch advisory for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and related offerings. The update for kernel-5.14.0-427.68.2.el9_4 fixes CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, and CVE-2026-64530.
Red Hat issued RHSA-2026:55837, an Important kpatch live patch advisory for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related offerings. The update for kernel-5.14.0-284.117.1.el9_2 fixes CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, and CVE-2026-64530.
Red Hat issued RHSA-2026:55763, an Important kpatch live patch advisory for Red Hat Enterprise Linux 9 targeting kernel-5.14.0-687.10.1.el9_8. The update fixes CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, CVE-2026-46244, and CVE-2026-64530.
Red Hat issued RHSA-2026:55762, an Important kpatch live patch advisory for Red Hat Enterprise Linux 8 targeting kernel-4.18.0-553.53.1.el8_10. The update addresses CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, and CVE-2026-64530.
Red Hat issued RHSA-2026:55761, an Important kpatch live patch advisory for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and related offerings. The update for kernel-4.18.0-477.97.1.el8_8 fixes CVE-2026-43038, CVE-2026-43125, CVE-2026-43329, and CVE-2026-64530.
Red Hat published RHSA-2026:55618, an Important live kernel patch advisory for Red Hat Enterprise Linux 10 targeting kernel-6.12.0-211.16.1.el10_2. The kpatch update remediates CVE-2026-31641, CVE-2026-43038, CVE-2026-43329, CVE-2026-46244, and CVE-2026-64530.
Red Hat published RHSA-2026:49214, an Important kernel security advisory for Red Hat Enterprise Linux 8. The update fixes CVE-2026-31692, CVE-2026-43116, CVE-2026-46150, and CVE-2026-64530 across multiple RHEL 8 variants and architectures, and Red Hat says systems must be rebooted after applying it.
Red Hat published RHSA-2026:49213, an Important kernel-rt security advisory for Red Hat Enterprise Linux 8 real-time offerings. The update fixes CVE-2026-31692, CVE-2026-43116, CVE-2026-46150, and CVE-2026-64530 and requires a reboot after installation.
A Red Hat Bugzilla entry described CVE-2026-31692 in rtnl_newlink(), where a missing CAP_NET_ADMIN check in the peer network namespace could let an unprivileged user create interfaces in arbitrary namespaces. The entry states the fix adds a netlink_ns_capable() check and notes the issue was addressed in RHEL 10 and RHEL 8 advisories.
Red Hat published RHSA-2026:45114, an Important kernel security advisory for Red Hat Enterprise Linux 10. The update fixes multiple Linux kernel vulnerabilities including CVE-2025-40237, CVE-2026-23110, CVE-2026-31692, CVE-2026-46099, CVE-2026-52973, and CVE-2026-53059.
Red Hat published RHSA-2026:23470, an Important security advisory for multiple Red Hat Enterprise Linux 8 kpatch live patch packages covering the 4.18.0-553 kernel series. The update fixes Linux kernel flaws including CVE-2026-46300 ("Fragnesia") and CVE-2026-46333 for RHEL 8 and Extended Life Cycle 8.10 variants.
Red Hat updated advisory RHSA-2026:55761 after its initial publication. The source content states the RHEL 8.8 SAP kpatch advisory was updated on 2026-08-19.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
12 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel security updates and live patches for multiple Red Hat Enterprise Linux versions to remediate several Linux kernel vulnerabilities, including `CVE-2026-43499`, `CVE-2026-46116`, and `CVE-2026-46227`. The updates span standard kernel packages for **RHEL 7 ELS** and **RHEL 9**, as well as **kpatch** live-patch modules for **RHEL 9** and **RHEL 10**, allowing some systems to receive fixes without a reboot. The advisories also bundle additional kernel issues such as `CVE-2026-45984`, `CVE-2026-53166`, `CVE-2026-64531`, and `CVE-2026-31684`, affecting a broad set of x86_64, ppc64le, s390x, and aarch64 product variants, including SAP, EUS, and ELS offerings. The patched flaws include an **rtmutex** bug in `remove_waiter()` that could manipulate the wrong task state during futex proxy locking, an **xfrm** state-deletion bug that triggered slab use-after-free and out-of-bounds writes under repeated list removal, and an **SCTP** `SCTP_SENDALL` iterator flaw that could leave a stale association pointer after the socket lock was dropped, creating use-after-free or type-confusion conditions. Red Hat said fixes were propagated across numerous RHEL 8, 9, and 10 streams and support channels, with standard kernel packages requiring a reboot and `kpatch` updates available for selected RHEL 9 and RHEL 10 kernels.
Aug 25, 2026
Red Hat released **Important** security updates for the Linux kernel across **RHEL 8, RHEL 9, and RHEL 10**, including `kernel-rt` for Real Time deployments, fixing vulnerabilities in core subsystems such as **SMB/CIFS client code, iSCSI target handling, SMC, `sched/psi`, `memfd`, UDF, netfilter, POSIX CPU timers, and AMD GPU drivers**. The advisories cover **nine CVEs in RHEL 8**, **26 CVEs in RHEL 9**, and **24 CVEs in RHEL 10**, with affected offerings spanning standard, Extended Life Cycle, Extended Update Support, SAP, NFV, and CodeReady Linux Builder channels across **x86_64, s390x, ppc64le, and aarch64**. Red Hat said systems should be **rebooted after applying the updates** and reiterated that kernel errata should be treated as security-relevant because of the kernel’s central role. Among the patched flaws, Red Hat detailed **`CVE-2026-53143`**, a **buffer overflow** in the `drm/amdkfd` driver on **GFX11** that could leak or corrupt adjacent GTT memory during CRIU checkpoint and restore operations because SDMA queues used compute-specific handlers with the wrong MQD size. The company also fixed **`CVE-2026-63952`** in **`memfd`**, where writable mappings could persist even when `SEAL_EXEC` implicitly applied `SEAL_WRITE`, weakening the expected write-seal guarantees and undermining **W^X** protections. The RHEL 9 advisory also includes non-security fixes, including a regression in `5.14.0-687.5.1.el9_8` that broke Wi-Fi when **FIPS** was enabled.
Aug 26, 2026
Red Hat released a series of **kernel** and **kernel-rt** security advisories affecting **RHEL 7 ELS, RHEL 8, RHEL 9, and RHEL 10** product streams, including AUS, EUS, SAP Solutions, Telecommunications, Extended Life Cycle, and Extended Update Support channels. The updates fix clusters of vulnerabilities across networking, storage, memory management, and filesystem components, with repeated remediation for flaws such as `CVE-2026-23270` in traffic control `act_ct`, `CVE-2026-31419` in the bonding driver, `CVE-2026-43163` in `md/bitmap`, and multiple libceph, netfilter, RDMA, SMB, IPv6, SCTP, ALSA, and BPF issues. Red Hat rated several advisories **Important** and some **Critical**, citing impacts that include denial of service, memory corruption, out-of-bounds reads, use-after-free conditions, and possible local privilege escalation. The advisories span updated kernel builds including `3.10.0-1160.151.1.el7`, `4.18.0-305.197.1.el8_4`, `4.18.0-477.150.1.el8_8`, `4.18.0-553.132.1.el8_10`, `5.14.0-284.176.1.el9_2`, `5.14.0-427.127.1.el9_4`, `5.14.0-570.119.1.el9_6`, and `6.12.0-55.82.1.el10_0`, and Red Hat said affected systems must be **rebooted** after patching. One separately documented flaw, `CVE-2025-71116`, was traced to libceph `decode_pool()` parsing of malformed `osdmap` data, allowing an authenticated remote Ceph OSD or monitor to crash a client kernel; Red Hat said the issue was fixed with explicit bounds checks and advised preventing the `libceph` module from loading where Ceph is not used.
Aug 25, 2026