Loading story…
Red Hat released a series of kernel security advisories across RHEL 8 and RHEL 9 product lines, covering standard, real-time, SAP, telecommunications, NFV, and extended life cycle channels. The updates address multiple high-impact flaws including CVE-2026-23216 (use-after-free in iSCSI target code), CVE-2026-45984 (use-after-free in the GFS2 iomap inline data write path), CVE-2026-46189 (double free in RDMA/vmw_pvrdma), CVE-2026-23191 (ALSA aloop), CVE-2026-23401 (KVM privilege escalation or denial of service), and CVE-2026-31431 (crypto algif_aead). Red Hat also disclosed broader kernel rollups for some RHEL 8.6 and 8.8 channels, including fixes for older and newer CVEs spanning NVMe, IPv6, tunneling, networking, memory corruption, overflow, and denial-of-service conditions.
The advisories include Important and Critical ratings depending on the affected branch, with one RHEL 8.6 Extended Update Support and Advanced Mission Critical update fixing 16 kernel vulnerabilities. Affected offerings include RHEL 8.6, 8.8, and 8 standard and specialized variants, plus RHEL 9.2 SAP-related builds across x86_64, ppc64le, aarch64, and s390x. Red Hat said updated kernel packages are available for each channel, noted some releases also include non-security fixes such as an .sbat section addition and an NFS log correction, and instructed customers to reboot systems after applying the updates for protections to take effect.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-07, Red Hat published RHSA-2026:36049, an Important security advisory for kernel-rt on RHEL 8. The Real Time kernel update fixed the same three vulnerabilities: CVE-2026-23216, CVE-2026-45984, and CVE-2026-46189.
On 2026-06-30, Red Hat issued RHSA-2026:33743, an Important kernel security advisory for RHEL 8. The update fixed three kernel vulnerabilities: CVE-2026-23216 in iSCSI target code, CVE-2026-45984 in GFS2, and CVE-2026-46189 in RDMA/vmw_pvrdma.
On 2026-06-12, Red Hat published RHSA-2026:25533, a Critical kernel security advisory for RHEL 8.6 Extended Update Support Long-Life Add-On and Advanced Mission Critical Update Support. The update released kernel version 4.18.0-372.195.1.el8_6 and addressed 16 vulnerabilities, including CVE-2024-41073, CVE-2023-53372, CVE-2025-40170, CVE-2026-23216, CVE-2026-31532, and several other 2025 and 2026 CVEs.
On 2026-06-03, Red Hat issued RHSA-2026:22964, an Important kernel security advisory for RHEL 8.8 SAP Solutions and Telecommunications Update Service variants. The update shipped kernel version 4.18.0-477.145.1.el8_8 and fixed seven vulnerabilities including CVE-2024-41073, CVE-2025-40170, CVE-2025-40135, CVE-2025-40158, CVE-2026-23216, CVE-2026-43037, and CVE-2026-43038.
On 2026-05-06, Red Hat issued RHSA-2026:14230, an Important kernel security advisory for several RHEL 8.6 service variants. The update provided kernel version 4.18.0-372.191.1.el8_6 and fixed CVE-2026-23191, CVE-2026-23401, and CVE-2026-31431.
On 2026-05-05, Red Hat published RHSA-2026:13734, an Important kernel security advisory for RHEL 9.2 variants. The update delivered kernel version 5.14.0-284.169.1.el9_2 and fixed multiple flaws including CVE-2026-23191, CVE-2026-23097, CVE-2026-23193, CVE-2026-31402, and CVE-2026-31431.
On 2026-06-04, Red Hat updated advisory RHSA-2026:22964 after its initial issuance the previous day. The source notes the advisory revision but does not describe additional technical changes beyond the existing kernel security update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **kernel** and **kernel-rt** security advisories affecting **RHEL 7 ELS, RHEL 8, RHEL 9, and RHEL 10** product streams, including AUS, EUS, SAP Solutions, Telecommunications, Extended Life Cycle, and Extended Update Support channels. The updates fix clusters of vulnerabilities across networking, storage, memory management, and filesystem components, with repeated remediation for flaws such as `CVE-2026-23270` in traffic control `act_ct`, `CVE-2026-31419` in the bonding driver, `CVE-2026-43163` in `md/bitmap`, and multiple libceph, netfilter, RDMA, SMB, IPv6, SCTP, ALSA, and BPF issues. Red Hat rated several advisories **Important** and some **Critical**, citing impacts that include denial of service, memory corruption, out-of-bounds reads, use-after-free conditions, and possible local privilege escalation. The advisories span updated kernel builds including `3.10.0-1160.151.1.el7`, `4.18.0-305.197.1.el8_4`, `4.18.0-477.150.1.el8_8`, `4.18.0-553.132.1.el8_10`, `5.14.0-284.176.1.el9_2`, `5.14.0-427.127.1.el9_4`, `5.14.0-570.119.1.el9_6`, and `6.12.0-55.82.1.el10_0`, and Red Hat said affected systems must be **rebooted** after patching. One separately documented flaw, `CVE-2025-71116`, was traced to libceph `decode_pool()` parsing of malformed `osdmap` data, allowing an authenticated remote Ceph OSD or monitor to crash a client kernel; Red Hat said the issue was fixed with explicit bounds checks and advised preventing the `libceph` module from loading where Ceph is not used.
Aug 25, 2026
Red Hat released multiple **kernel security advisories** for Red Hat Enterprise Linux 8, 9, and 10 channels to address several Linux kernel vulnerabilities, including **CVE-2026-23097**, **CVE-2026-23193**, **CVE-2026-31402**, **CVE-2026-31431**, and **CVE-2026-43077**. The flaws span a hugetlb folio migration deadlock that can trigger system hangs and denial of service, a use-after-free in iSCSI target code, a `qla2xxx` double-free that may enable denial of service or privilege escalation, a heap overflow in the NFSv4.0 LOCK replay cache, and a crypto `algif_aead` buffer-size validation issue that could lead to crashes, memory corruption, memory disclosure, or possible code execution in some contexts. The updates were published through advisories including **RHSA-2026:11313**, **RHSA-2026:13664**, **RHSA-2026:13681**, **RHSA-2026:13887**, and **RHSA-2026:14165**, covering product variants such as RHEL 8.4, 8.6, 8.8, 9.6, and 10.0 support channels. Red Hat rated several of the kernel updates as **Important** and noted that no acceptable mitigation was available for the hugetlb deadlock issue; affected systems require installation of the updated kernel packages and a **reboot** for protections to take effect.
Aug 25, 2026
Red Hat released a series of **Important** and **Critical** kernel security advisories across **RHEL 8, 9, and 10** product lines, including **kernel-rt**, **Extended Update Support**, **SAP**, and **RHEL for NVIDIA**, to remediate multiple Linux kernel vulnerabilities. The updates cover issues such as `CVE-2026-23270`, a use-after-free in traffic control `act_ct` that can cause denial of service and may allow privilege escalation under specific misconfigurations; `CVE-2026-31419`, a bonding driver race condition that can trigger a use-after-free and kernel crash; `CVE-2026-31402`, a heap overflow in the NFSv4.0 LOCK replay cache that can be triggered remotely by unauthenticated attackers; and `CVE-2026-31431` in `crypto: algif_aead`, alongside several other kernel flaws affecting networking, storage, virtualization, and memory handling. Advisories including **RHSA-2026:13566**, **RHSA-2026:14137**, **RHSA-2026:22334**, **RHSA-2026:27354**, and **RHSA-2026:33486** show the fixes were distributed across standard and specialized kernels for x86_64, aarch64, s390x, and ppc64le systems. Red Hat said some updates also address local privilege-escalation bugs such as **Dirty Frag** and **Fragnesia**, as well as kernel panic conditions in real-time builds. Affected environments include Real Time Linux, NFV, SAP-focused deployments, and NVIDIA-enabled RHEL 10 systems, and Red Hat instructed customers to install the updated kernel packages and **reboot** for the protections to take effect.
Aug 25, 2026