Loading story…
Red Hat released multiple Important kernel advisories across RHEL 8, 9, and 10 to address Linux kernel flaws including CVE-2025-39766 in net/sched and CVE-2025-68741 in the qla2xxx SCSI driver. Advisories RHSA-2026:8921 and RHSA-2026:9264 patched both issues for broad RHEL 9 and RHEL 10 product lines, while RHSA-2026:9131, RHSA-2026:9135, and RHSA-2026:10996 included fixes for CVE-2025-68741 alongside other kernel bugs in standard, real-time, and extended support channels. Red Hat said affected systems should be rebooted after applying the updated kernel packages.
CVE-2025-39766 stems from the Linux traffic-control scheduler, where cake_enqueue() could return NET_XMIT_SUCCESS after dropping packets past buffer_limit, allowing htb_enqueue() to activate an empty child qdisc and trigger a kernel warning; the fix changes the return value to NET_XMIT_CN. CVE-2025-68741 affects drivers/scsi/qla2xxx/qla_nvme.c, where an error path improperly frees a purex item with kfree() instead of qla24xx_free_purex_item(), creating a risk of memory corruption. Additional Red Hat kernel advisories in the same period also bundled other flaws such as race conditions, heap overflows, use-after-free bugs, and privilege-escalation issues across legacy, SAP, real-time, and extended lifecycle offerings.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:14925 for Red Hat Enterprise Linux 7 Extended Lifecycle Support, fixing CVE-2018-16885, CVE-2025-40240, CVE-2026-23191, and CVE-2026-31402. The update covered x86_64, s390x, ppc64, and ppc64le ELS systems.
Red Hat issued RHSA-2026:14301 for kernel-rt on Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and 9.2 Extended Life Cycle. The advisory fixed multiple kernel vulnerabilities including CVE-2026-23097, CVE-2026-23193, CVE-2026-23191, CVE-2026-31402, and CVE-2026-31431.
Red Hat published RHSA-2026:14230 for several RHEL 8.6 service variants, fixing CVE-2026-23191, CVE-2026-23401, and CVE-2026-31431. The update applied to Advanced Mission Critical Update Support, SAP Solutions, and Telecommunications Update Service offerings.
Red Hat issued RHSA-2026:10996 for Red Hat Enterprise Linux 10.0 Extended Update Support, fixing CVE-2025-68741 along with CVE-2026-23001 and CVE-2026-23111. The advisory covered x86_64, s390x, ppc64le, and aarch64 channels.
Red Hat published RHSA-2026:9264 for Red Hat Enterprise Linux 10, fixing CVE-2025-39766 in net/sched and CVE-2025-68741 in qla2xxx. The update covered multiple RHEL 10 product variants, including EUS, ELC, and CodeReady Linux Builder channels.
Red Hat issued RHSA-2026:9135 for RHEL 8 real-time offerings, fixing CVE-2025-68741 and CVE-2026-23191 in kernel-rt packages. The advisory applied to Real Time, Real Time for NFV, and x86_64 ELC 8.10 variants.
Red Hat issued RHSA-2026:9131 for Red Hat Enterprise Linux 8, fixing CVE-2025-68741 in the qla2xxx SCSI component and CVE-2026-23191 in ALSA aloop. Updated kernel packages were released for multiple RHEL 8 architectures and ELC variants.
Red Hat published RHSA-2026:8921 for Red Hat Enterprise Linux 9, fixing CVE-2025-39766 in net/sched along with CVE-2025-68741. The advisory covered multiple RHEL 9 variants and instructed customers to reboot after applying the update.
The Linux kernel CVE team assigned and announced CVE-2025-68741 for an improper freeing bug in the qla2xxx SCSI driver that can lead to memory corruption. The announcement said the issue was fixed in kernel versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1.
An upstream advisory for CVE-2025-39766 was published on lore.kernel.org, documenting the Linux kernel net/sched flaw involving cake_enqueue returning NET_XMIT_SUCCESS after packet drops past buffer_limit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** security advisories for the Linux kernel in **Red Hat Enterprise Linux 9.6** channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to **reboot systems after installation**. The newer advisory, **RHSA-2026:34094**, updates the kernel to `5.14.0-570.125.1.el9_6` across `x86_64`, `aarch64`, `ppc64le`, and `s390x`, and addresses **18 CVEs** spanning subsystems such as **netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP,** and process exit handling. An earlier advisory, **RHSA-2026:14339**, also targeted RHEL 9.6 kernel packages and listed impacts including **denial of service, memory corruption, privilege escalation,** and **use-after-free** flaws in components including **nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead,** and **CAN raw**. One of the patched issues, **CVE-2025-68741**, affects the Linux kernel's **qla2xxx SCSI driver** and stems from improper freeing of a `purex` item in `qla2xxx_process_purls_iocb()`. Red Hat and Bugzilla records say the flaw occurs when memory obtained from `qla24xx_alloc_purex_item()` is incorrectly released with `kfree()` instead of `qla24xx_free_purex_item()`, creating a **CWE-763** invalid pointer release condition that can cause **memory corruption**. Red Hat rated the issue **Moderate** for its products, noted that fixes were shipped across multiple **RHEL 8, 9, and 10** kernel packages, and said **RHEL 6** is not affected because the vulnerable code is absent.
Aug 25, 2026
Red Hat released multiple **kernel security advisories** across RHEL 8, 9, and 10 product streams to remediate a set of Linux kernel vulnerabilities affecting core subsystems including **CAN raw sockets**, **RDMA/umad**, and the **qla2xxx** SCSI driver. The updates span standard, real-time, Extended Update Support, Extended Life Cycle, SAP, Telecommunications, and mission-critical channels, with advisories including `RHSA-2026:13932`, `RHSA-2026:18134`, `RHSA-2026:19521`, `RHSA-2026:19875`, `RHSA-2026:20130`, and `RHSA-2026:27353`. Red Hat rated several of the releases **Important** and said affected systems must be **rebooted** after installation for the fixes to take effect. Among the patched issues, **CVE-2026-31532** fixes a use-after-free in `net/can/raw.c` where `raw_rcv()` could access freed `ro->uniq` memory during deferred receiver deletion, while **CVE-2026-23243** addresses an RDMA `umad` flaw in `ib_umad_write()` that could turn a negative `data_len` into memory corruption through an out-of-bounds `memset`. Red Hat advisories also include **CVE-2025-71238**, a double-free bug in `qla2xxx` BSG request handling that can crash the kernel and may enable privilege escalation, alongside other kernel flaws such as local privilege escalation, denial of service, and unauthorized file reads. Upstream Linux kernel guidance for the CAN issue points administrators to updated stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026