Loading story…
Red Hat released a series of Important and Critical kernel security advisories across RHEL 8, 9, and 10 product lines, including kernel-rt, Extended Update Support, SAP, and RHEL for NVIDIA, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as CVE-2026-23270, a use-after-free in traffic control act_ct that can cause denial of service and may allow privilege escalation under specific misconfigurations; CVE-2026-31419, a bonding driver race condition that can trigger a use-after-free and kernel crash; CVE-2026-31402, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and CVE-2026-31431 in crypto: algif_aead, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling.
Advisories including RHSA-2026:13566, RHSA-2026:14137, RHSA-2026:22334, RHSA-2026:27354, and RHSA-2026:33486 show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as Dirty Frag and Fragnesia, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and reboot for the protections to take effect.
See real exploitation activity before you spend the cycle.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:33486, a Critical kernel security advisory for Red Hat Enterprise Linux for NVIDIA on ARM 64 10. The update fixes multiple Linux kernel vulnerabilities, including CVE-2026-31431, CVE-2026-43284, CVE-2026-46300, and CVE-2026-46333.
Red Hat published RHSA-2026:27354, an Important kernel-rt update for Red Hat Enterprise Linux 8 Real Time variants. The advisory fixes eight kernel vulnerabilities, including CVE-2026-31419, and also resolves a kernel panic in replenish_dl_entity().
Red Hat published RHSA-2026:22334, an Important kernel security update for Red Hat Enterprise Linux 10.0 Extended Update Support. The advisory includes a fix for CVE-2026-31419 in the bonding driver along with four other kernel vulnerabilities.
Red Hat published RHSA-2026:19540 for NVIDIA for RHEL 10 on aarch64, rated Critical by Red Hat Product Security. The advisory fixes Linux kernel vulnerabilities including CVE-2026-46300 and CVE-2026-46333 and requires a reboot after installation.
Red Hat published RHSA-2026:14137, an Important kernel-rt security update for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on x86_64. The update fixes multiple kernel vulnerabilities, including CVE-2026-31402 and CVE-2026-31431, and requires a reboot after installation.
Red Hat published RHSA-2026:13566, an Important kernel security update for Red Hat Enterprise Linux 10. The advisory fixes multiple vulnerabilities including CVE-2026-23270, CVE-2026-31402, CVE-2026-31419, and CVE-2026-31431.
An upstream advisory was published for CVE-2026-31402, detailing a heap overflow in the Linux kernel NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers using cooperating clients.
Red Hat published its CVE entry for CVE-2026-23270, classifying the Linux kernel act_ct flaw as Moderate severity and noting it requires a specific traffic control configuration to trigger.
An upstream linux-cve-announce advisory for CVE-2026-23270 was published, describing a Linux kernel act_ct use-after-free issue in traffic control that can lead to denial of service or possible privilege escalation.
Red Hat released RHSA-2026:35863 to fix CVE-2026-23270 for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and 8.8 Telecommunications Update Service kernel packages.
Red Hat last modified its CVE-2026-23270 record, reflecting updated tracking information for the Linux kernel act_ct vulnerability and its remediation across Red Hat product streams.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **kernel security advisories** across **RHEL 8** and **RHEL 9** product lines, covering standard, real-time, SAP, telecommunications, NFV, and extended life cycle channels. The updates address multiple high-impact flaws including `CVE-2026-23216` (use-after-free in iSCSI target code), `CVE-2026-45984` (use-after-free in the GFS2 iomap inline data write path), `CVE-2026-46189` (double free in `RDMA/vmw_pvrdma`), `CVE-2026-23191` (ALSA aloop), `CVE-2026-23401` (KVM privilege escalation or denial of service), and `CVE-2026-31431` (crypto `algif_aead`). Red Hat also disclosed broader kernel rollups for some RHEL 8.6 and 8.8 channels, including fixes for older and newer CVEs spanning NVMe, IPv6, tunneling, networking, memory corruption, overflow, and denial-of-service conditions. The advisories include **Important** and **Critical** ratings depending on the affected branch, with one RHEL 8.6 Extended Update Support and Advanced Mission Critical update fixing **16 kernel vulnerabilities**. Affected offerings include RHEL 8.6, 8.8, and 8 standard and specialized variants, plus RHEL 9.2 SAP-related builds across `x86_64`, `ppc64le`, `aarch64`, and `s390x`. Red Hat said updated kernel packages are available for each channel, noted some releases also include non-security fixes such as an `.sbat` section addition and an NFS log correction, and instructed customers to **reboot systems after applying the updates** for protections to take effect.
Aug 25, 2026
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026