Loading story…
Red Hat released Important security updates for multiple kpatch live patch packages on Red Hat Enterprise Linux 8 to address several Linux kernel flaws, including CVE-2026-31419, a use-after-free bug in the bonding driver. The issue occurs in bond_xmit_broadcast() because of a race condition during concurrent slave enslave and release operations, which can double-free the original socket buffer and crash the system. Red Hat said a local low-privilege attacker could exploit the flaw to trigger a denial of service, and rated the vulnerability with a CVSS v3 score of 7.0.
The fixes were included in advisory RHSA-2026:36530 for kernel live patch modules for kernel-4.18.0-553.53.1.el8_10, alongside patches for CVE-2026-23401 and CVE-2026-31402, which affect KVM and nfsd. Red Hat said the bonding-driver flaw affects RHEL 8.8 and later, RHEL 9.2 and later, RHEL 10, RHEL 6, and Red Hat In-Vehicle OS 2.0, while RHEL 7, 8.2, 8.4, 8.6, and 9.0 are not affected; the July advisory specifically covers affected RHEL 8 x86_64 and ppc64le systems, including Extended Life Cycle 8.10 variants.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important security advisory RHSA-2026:36534 for multiple Red Hat Enterprise Linux 9.6 kpatch live patch packages, including Extended Update Support, AUS, SAP Solutions, and Extended Life Cycle variants. The update fixes CVE-2026-23401, CVE-2026-31402, and CVE-2026-31419 for kernel-5.14.0-570.17.1.el9_6 on x86_64 and ppc64le.
Red Hat published Important security advisory RHSA-2026:36533 for multiple Red Hat Enterprise Linux 9.4 kpatch live patch packages, including AUS, SAP Solutions, and Extended Life Cycle variants on x86_64 and ppc64le. The update fixes CVE-2026-23401, CVE-2026-31402, and CVE-2026-31419 for kernel 5.14.0-427 series builds.
Red Hat published Important security advisory RHSA-2026:36532 for multiple Red Hat Enterprise Linux 9.2 kpatch live patch packages, including AUS, SAP Solutions, and Extended Life Cycle variants on x86_64 and ppc64le. The update fixes CVE-2026-23401, CVE-2026-31402, and CVE-2026-31419 for kernel-5.14.0-284.117.1.el9_2.
Red Hat issued Important security advisory RHSA-2026:36530 for multiple Red Hat Enterprise Linux 8 kpatch live patch packages. The update fixed CVE-2026-23401, CVE-2026-31402, and CVE-2026-31419 for kernel-4.18.0-553.53.1.el8_10 on x86_64 and ppc64le, including Extended Life Cycle 8.10 variants.
Red Hat published security advisory RHSA-2026:13566 for the Red Hat Enterprise Linux 10 kernel to address CVE-2026-31419.
Red Hat published details for CVE-2026-31419, describing an Important-severity Linux kernel bonding driver use-after-free flaw that a low-privileged local attacker could exploit to cause denial of service. The entry also identified affected and unaffected Red Hat product versions and assigned a CVSS v3 score of 7.0.
Greg Kroah-Hartman published the Linux kernel CVE announcement for CVE-2026-31419, describing a use-after-free flaw in the bonding driver’s bond_xmit_broadcast() caused by a race during slave list iteration. The notice identified upstream fixes in kernel versions 6.18.22, 6.19.12, and 7.0 and recommended upgrading to the latest stable kernel release.
Red Hat published RHSA-2026:36531 for the Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions kpatch-patch package to remediate CVE-2026-31419.
Red Hat published RHSA-2026:35870 for the Red Hat Enterprise Linux 10 kpatch-patch package to address CVE-2026-31419.
Red Hat published RHSA-2026:27353 for the Red Hat Enterprise Linux 8 kernel and RHSA-2026:27354 for the RHEL 8 kernel-rt package to fix CVE-2026-31419.
Red Hat published RHSA-2026:25191 for the Red Hat Enterprise Linux 10 kernel as another advisory addressing CVE-2026-31419.
Red Hat published RHSA-2026:22334 for the Red Hat Enterprise Linux 10.0 Extended Update Support kernel to remediate CVE-2026-31419.
Red Hat published RHSA-2026:19521 on May 20, 2026 for Red Hat Enterprise Linux 8.8 Telecommunications Update Service and Update Services for SAP Solutions kernel packages to fix CVE-2026-31419.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released fixes for **CVE-2023-28466**, a moderate-severity race condition in the Linux kernel TLS subsystem's `do_tls_getsockopt` function. The flaw can trigger a use-after-free condition or NULL-pointer dereference; a local attacker with low privileges could affect system confidentiality, integrity, and availability. Red Hat rates the vulnerability **CVSS 7.0**. The remediation includes RHEL 8 kernel packages under **RHSA-2023:3847**, including `kernel-4.18.0-477.15.1.el8_8` for supported x86_64, s390x, ppc64le, and aarch64 variants, with fixes also available for affected RHEL 9 kernels. Organizations should install the applicable updates and reboot systems; where patching cannot occur immediately, Red Hat recommends preventing the TLS kernel module from loading at boot.
Aug 26, 2026
Red Hat released kernel updates addressing **CVE-2025-38211**, a use-after-free vulnerability in the Linux kernel's RDMA iWARP Connection Manager (`RDMA/iwcm`). The flaw can occur when an event-handler work item drops the final reference to a `cm_id` while the workqueue can still access the associated work object; it was reproducible through the `blktests` `nvme/061` test using RDMA transport and the `siw` driver. The fix moves final `cm_id` reference handling into the connection-manager destruction context, preventing work objects from being freed prematurely. Red Hat included the fix in the Moderate-severity RHEL 8 advisory **RHSA-2025:15008**, providing kernel `4.18.0-553.72.1.el8_10` for x86_64, aarch64, ppc64le, and s390x systems, including selected Extended Life Cycle deployments; administrators should install the updated packages and reboot. Red Hat also issued related kernel security updates across RHEL product streams, including RHEL 10 packages that remediate multiple kernel flaws.
Aug 26, 2026
Red Hat released an **Important** update, `RHSA-2025:15786`, for Red Hat Enterprise Linux 8 Real Time kernel packages to remediate three kernel flaws: `CVE-2025-38350` in `net/sched`, `CVE-2025-38392` in the IDPF driver control queue, and `CVE-2025-38449` in DRM/GEM framebuffer-handle reference management. The advisory affects RHEL for Real Time 8, Real Time for NFV 8, and x86_64 Extended Life Cycle 8.10; the fixed package is `kernel-rt-4.18.0-553.75.1.rt7.416.el8_10`. `CVE-2025-38350` is a use-after-free in the Credit-Based Shaper (`sch_cbs`) queuing discipline. Improper reset handling can leave queue lengths inconsistent and trigger a use-after-free in a parent HFSC scheduler during interface resets. Red Hat rates the issue CVSS 7.0, while NVD and cve.org rate it 7.8; on RHEL 8 and later, non-root users may be able to exploit it through unprivileged user namespaces. Organizations should deploy the updated kernel packages and reboot affected hosts; where patching cannot occur promptly, prevent the `sch_cbs` module from loading.
Aug 26, 2026