Loading story…
Red Hat released multiple Important security advisories for the Linux kernel in Red Hat Enterprise Linux 9.6 channels, including Extended Update Support, delivering fixes for a broad set of vulnerabilities and requiring customers to reboot systems after installation. The newer advisory, RHSA-2026:34094, updates the kernel to 5.14.0-570.125.1.el9_6 across x86_64, aarch64, ppc64le, and s390x, and addresses 18 CVEs spanning subsystems such as netfilter, ALSA, MPTCP, RDMA, TCP, DLM, SCSI, IPv6, SCTP, and process exit handling. An earlier advisory, RHSA-2026:14339, also targeted RHEL 9.6 kernel packages and listed impacts including denial of service, memory corruption, privilege escalation, and use-after-free flaws in components including nfsd, qla2xxx, RDMA umad, KVM, crypto algif_aead, and CAN raw.
One of the patched issues, CVE-2025-68741, affects the Linux kernel's qla2xxx SCSI driver and stems from improper freeing of a purex item in qla2xxx_process_purls_iocb(). Red Hat and Bugzilla records say the flaw occurs when memory obtained from qla24xx_alloc_purex_item() is incorrectly released with kfree() instead of qla24xx_free_purex_item(), creating a CWE-763 invalid pointer release condition that can cause memory corruption. Red Hat rated the issue Moderate for its products, noted that fixes were shipped across multiple RHEL 8, 9, and 10 kernel packages, and said RHEL 6 is not affected because the vulnerable code is absent.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important advisory RHSA-2026:34094 for RHEL 9.6 Extended Update Support and related channels, providing kernel version 5.14.0-570.125.1.el9_6. The advisory addresses 18 CVEs across multiple kernel subsystems including netfilter, ALSA, RDMA, TCP, SCSI, IPv6, SCTP, and process exit handling, and requires a reboot after applying the update.
Red Hat issued Important advisory RHSA-2026:14339 for RHEL 9.6 Extended Update Support and related channels, shipping kernel version 5.14.0-570.112.1.el9_6. The update fixes multiple kernel CVEs including CVE-2025-68741, and Red Hat instructed administrators to reboot after installation.
A Red Hat Bugzilla record documented the qla2xxx vulnerability details, explaining that qla2xxx_process_purls_iocb() incorrectly used kfree() on items that might come from a pre-allocated pool. The record states the fix replaced kfree() with qla24xx_free_purex_item().
Red Hat published Moderate-severity advisory RHSA-2026:1194 for RHEL 9.6 Extended Update Support and related offerings, shipping kernel version 5.14.0-570.81.1.el9_6. The update fixes 11 Linux kernel vulnerabilities across components including openvswitch, drm/xe, irqchip/gic-v2m, scsi lpfc, Bluetooth, mptcp, devlink, and vmwgfx, and requires a reboot after installation.
Red Hat published its CVE page for CVE-2025-68741, describing a Linux kernel qla2xxx flaw caused by improper freeing of a purex item that can lead to memory corruption. The entry rates the issue Moderate and notes affected and fixed Red Hat product streams.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **Important** kernel advisories across RHEL 8, 9, and 10 to address Linux kernel flaws including `CVE-2025-39766` in `net/sched` and `CVE-2025-68741` in the `qla2xxx` SCSI driver. Advisories `RHSA-2026:8921` and `RHSA-2026:9264` patched both issues for broad RHEL 9 and RHEL 10 product lines, while `RHSA-2026:9131`, `RHSA-2026:9135`, and `RHSA-2026:10996` included fixes for `CVE-2025-68741` alongside other kernel bugs in standard, real-time, and extended support channels. Red Hat said affected systems should be rebooted after applying the updated kernel packages. `CVE-2025-39766` stems from the Linux traffic-control scheduler, where `cake_enqueue()` could return `NET_XMIT_SUCCESS` after dropping packets past `buffer_limit`, allowing `htb_enqueue()` to activate an empty child qdisc and trigger a kernel warning; the fix changes the return value to `NET_XMIT_CN`. `CVE-2025-68741` affects `drivers/scsi/qla2xxx/qla_nvme.c`, where an error path improperly frees a `purex` item with `kfree()` instead of `qla24xx_free_purex_item()`, creating a risk of memory corruption. Additional Red Hat kernel advisories in the same period also bundled other flaws such as race conditions, heap overflows, use-after-free bugs, and privilege-escalation issues across legacy, SAP, real-time, and extended lifecycle offerings.
Aug 25, 2026
Red Hat released multiple **kernel security advisories** across RHEL 8, 9, and 10 product streams to remediate a set of Linux kernel vulnerabilities affecting core subsystems including **CAN raw sockets**, **RDMA/umad**, and the **qla2xxx** SCSI driver. The updates span standard, real-time, Extended Update Support, Extended Life Cycle, SAP, Telecommunications, and mission-critical channels, with advisories including `RHSA-2026:13932`, `RHSA-2026:18134`, `RHSA-2026:19521`, `RHSA-2026:19875`, `RHSA-2026:20130`, and `RHSA-2026:27353`. Red Hat rated several of the releases **Important** and said affected systems must be **rebooted** after installation for the fixes to take effect. Among the patched issues, **CVE-2026-31532** fixes a use-after-free in `net/can/raw.c` where `raw_rcv()` could access freed `ro->uniq` memory during deferred receiver deletion, while **CVE-2026-23243** addresses an RDMA `umad` flaw in `ib_umad_write()` that could turn a negative `data_len` into memory corruption through an out-of-bounds `memset`. Red Hat advisories also include **CVE-2025-71238**, a double-free bug in `qla2xxx` BSG request handling that can crash the kernel and may enable privilege escalation, alongside other kernel flaws such as local privilege escalation, denial of service, and unauthorized file reads. Upstream Linux kernel guidance for the CAN issue points administrators to updated stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
Red Hat released two **Important** security advisories for the Linux kernel in **Red Hat Enterprise Linux 9.6 Extended Update Support**, updating affected systems first to `5.14.0-570.129.1.el9_6` and later to `5.14.0-570.132.1.el9_6`. The earlier advisory addressed eight kernel CVEs spanning components including **VMCI**, **vt**, **Bluetooth**, **AMD display**, **SMB client**, **traffic scheduling**, **xfrm**, and **DRM GEM**, alongside several bug fixes and enhancements. Red Hat said affected systems must be rebooted after applying the packages. A subsequent advisory fixed three additional kernel vulnerabilities: `CVE-2025-71131`, `CVE-2026-46054`, and `CVE-2026-52976`. Red Hat’s Bugzilla entry for **CVE-2025-71131** said the flaw was in the kernel `crypto: seqiv` code, where `req->iv` could be used after `crypto_aead_encrypt` returns even though the underlying request may already have been freed through asynchronous completion; the fix replaces that unsafe post-call check with a separate variable, `unaligned_info`. Red Hat said the issue was remediated for RHEL 9.6 EUS through **RHSA-2026:52667**, and customers were again instructed to apply the update and reboot.
Aug 27, 2026