Loading story…
Red Hat released kernel security update RHSA-2025:9348 for Red Hat Enterprise Linux 10 to remediate multiple Linux kernel flaws, including CVE-2025-21999, a use-after-free bug in proc_get_inode(). The vulnerability stems from a race condition between module removal and /proc inode creation, allowing proc entries to reference module-owned proc_ops after the module has been freed and potentially causing a kernel page fault.
The Linux kernel CVE team said the flaw dates back to kernel 2.6.23 and was corrected in several stable branches, including 6.1.132, 6.6.85, 6.12.21, 6.13.9, and 6.14, while recommending full stable-kernel upgrades instead of cherry-picking fixes. Red Hat’s advisory also addressed CVE-2025-23150 and CVE-2025-37738, two ext4 issues involving an off-by-one error in do_split and improper handling of extended attributes beyond the end of data, and said affected RHEL 10 systems must be rebooted after installing the updated kernel packages.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:9348 for Red Hat Enterprise Linux 10, providing updated kernel packages that address CVE-2025-21999 along with CVE-2025-23150 and CVE-2025-37738. The advisory rates the update Moderate severity and says systems must be rebooted after applying it.
The vulnerability was fixed across multiple kernel branches, including 6.1.132, 6.6.85, 6.12.21, 6.13.9, and 6.14, with branch-specific commits listed in the CVE announcement.
The Linux kernel CVE team assigned CVE-2025-21999 to a race-condition-driven use-after-free vulnerability in proc_get_inode() affecting proc-related code.
The CVE record states the proc_get_inode() use-after-free vulnerability was introduced in Linux kernel 2.6.23 by commit 778f3dd5a13c9e1642e0b2efea4b769387a70afa.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026
Red Hat released Important Linux kernel updates for Red Hat Enterprise Linux 9 to remediate multiple security flaws, including **CVE-2025-38052**, a use-after-free read in the TIPC networking subsystem. The flaw occurs when asynchronous encryption work accesses TIPC cryptographic state after it has been freed during network-namespace deletion; the upstream fix preserves a network-namespace reference until encryption processing finishes. The RHSA-2025:12746 update also addresses other kernel use-after-free issues, an integer-overflow vulnerability in CIFS processing, and an information-disclosure flaw in VMware VMCI datagram handling. Affected RHEL 9 systems include x86_64, ARM64, IBM Z, and Power little-endian deployments across standard, EUS, ELS, SAP, AUS, and CodeReady Linux Builder offerings; Red Hat also issued fixes for CVE-2025-38052 in supported RHEL 8 and RHEL 10 variants. Organizations should apply the appropriate kernel updates and reboot systems for the fixes to take effect.
Aug 26, 2026