Loading story…
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9 and RHEL 10, addressing a broad set of memory-safety, denial-of-service, information-disclosure, and privilege-escalation risks across subsystems including BPF, KVM, netfilter, MPTCP, SMB, RDMA, NFS, and device drivers. The fixes are delivered through RHSA-2025:20518 for RHEL 9 and RHSA-2026:18134 for RHEL 10, covering supported x86_64, aarch64, s390x, and ppc64le variants, including applicable extended-support offerings.
Among the remediated flaws, CVE-2025-21839 affects KVM/x86 handling of the guest DR6 debug register: under certain fast-path VM-exit conditions, particularly in nested VMX deployments, KVM could restore a stale DR6 value and overwrite the guest's current value. CVE-2024-53216 affects the NFS server (nfsd), where cache objects could be released while RCU readers still accessed them, creating a slab use-after-free condition; the fix defers object release until after an RCU grace period. Red Hat requires affected systems to be rebooted after installing the updated kernel for protections to take effect.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Moderate-severity advisory RHSA-2026:18134, making updated RHEL 10 kernel packages available for multiple architectures and product variants. The update fixed numerous flaws, including CVE-2025-21839, CVE-2025-40257, CVE-2026-23111, CVE-2026-23210, and CVE-2026-23243; Red Hat instructed administrators to reboot after applying it.
Red Hat documented CVE-2024-57981, a moderate Linux kernel xHCI USB driver NULL pointer dereference that can allow a local low-privileged user to crash the kernel. Kernel fixes were released for RHEL 9 in RHSA-2025:20518 and RHEL 10 in RHSA-2025:20095; RHEL 9 kernel-rt was marked will not fix.
Red Hat issued Moderate-severity advisory RHSA-2025:20518 for RHEL 9, providing an updated kernel that remediates numerous vulnerabilities across kernel subsystems. The update addressed CVE-2025-21839 and CVE-2024-53216, among other flaws, and required systems to be rebooted after installation.
Red Hat issued RHSA-2025:6966 for Red Hat Enterprise Linux 9, fixing the moderate nfsd export-cache use-after-free vulnerability CVE-2024-53216.
CVE-2024-58014, a moderate Linux kernel brcmsmac Wi-Fi driver out-of-bounds read in wlc_phy_iqcal_gainparams_nphy(), was publicly listed. The missing gain-range check could permit local disclosure of sensitive memory or cause a system crash.
Red Hat addressed CVE-2024-53216 for Red Hat Enterprise Linux 9.6 Extended Update Support through advisory RHSA-2026:14339.
Red Hat addressed the nfsd RCU-related use-after-free vulnerability CVE-2024-53216 in RHEL 10 through advisory RHSA-2025:20095.
Red Hat resolved CVE-2025-21851, an eBPF arena_map_free() flaw that can cause segmentation faults and soft lockups on AArch64 systems using 64 KB pages. The issue was addressed for RHEL 9 in RHSA-2025:20518 and for RHEL 10 in RHSA-2025:20095.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated Linux kernel updates for **RHEL 8** and **RHEL 9**, including RHEL 8.6 Extended Update Support, addressing numerous memory-safety, privilege-escalation, denial-of-service, and speculative-execution vulnerabilities. The updates cover flaws such as `CVE-2024-1086`, an `nf_tables` use-after-free vulnerability; `CVE-2023-6546`, a GSM multiplexing race condition that can enable privilege escalation; net/sched classifier issues `CVE-2023-4128`, `CVE-2023-4206`, `CVE-2023-4207`, and `CVE-2023-4208`; and Intel Gather Data Sampling (`CVE-2022-40982`). The fixes also address `CVE-2023-4155`, a KVM double-fetch race affecting multi-vCPU AMD SEV-ES and SEV-SNP guests that could recursively invoke the VMGEXIT handler and exhaust kernel stack space. Red Hat noted that default `CONFIG_VMAP_STACK` protections mitigate the theoretical guest-to-host escape scenario on RHEL 8 and 9. Separate vmwgfx use-after-free flaws, `CVE-2022-38457` and `CVE-2022-40133`, could allow a local user with DRM-device access to crash affected systems. Organizations should install the applicable kernel packages across supported architectures and reboot hosts to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026