Loading story…
Red Hat released multiple kernel security advisories for Red Hat Enterprise Linux 8, 9, and 10 channels to address several Linux kernel vulnerabilities, including CVE-2026-23097, CVE-2026-23193, CVE-2026-31402, CVE-2026-31431, and CVE-2026-43077. The flaws span a hugetlb folio migration deadlock that can trigger system hangs and denial of service, a use-after-free in iSCSI target code, a qla2xxx double-free that may enable denial of service or privilege escalation, a heap overflow in the NFSv4.0 LOCK replay cache, and a crypto algif_aead buffer-size validation issue that could lead to crashes, memory corruption, memory disclosure, or possible code execution in some contexts.
The updates were published through advisories including RHSA-2026:11313, RHSA-2026:13664, RHSA-2026:13681, RHSA-2026:13887, and RHSA-2026:14165, covering product variants such as RHEL 8.4, 8.6, 8.8, 9.6, and 10.0 support channels. Red Hat rated several of the kernel updates as Important and noted that no acceptable mitigation was available for the hugetlb deadlock issue; affected systems require installation of the updated kernel packages and a reboot for protections to take effect.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:14165, an Important kernel security update for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and 8.4 Extended Update Support Long-Life Add-On. The advisory fixed CVE-2026-23193 along with CVE-2025-71238, CVE-2026-31402, and CVE-2026-31431.
Red Hat published RHSA-2026:13681, an Important kernel security update for Red Hat Enterprise Linux 8.8 SAP Solutions and Telecommunications Update Service. The advisory fixed CVE-2026-23097, CVE-2026-23193, CVE-2026-31402, and CVE-2026-31431.
Red Hat published RHSA-2026:13664, an Important kernel security update for several Red Hat Enterprise Linux 8.6 service variants. The advisory fixed CVE-2026-23097 along with CVE-2026-23193, CVE-2025-71238, and CVE-2026-31402.
Red Hat published RHSA-2026:13887 for Red Hat Enterprise Linux 10.0 Extended Update Support and related channels. The advisory fixed CVE-2026-31431 in the Linux kernel algif_aead crypto component.
Red Hat published RHSA-2026:11313, a Moderate-severity kernel security update for Red Hat Enterprise Linux 9.6. The advisory fixed CVE-2026-23097 and CVE-2026-31402 across multiple RHEL 9.6 channels and architectures.
Red Hat published RHSA-2026:6572, a Moderate-severity security advisory for Red Hat Enterprise Linux 8 kernel-rt packages. The update fixed CVE-2024-26984, CVE-2026-23193, CVE-2026-23231, and CVE-2025-71238 across RHEL for Real Time 8, NFV 8, and Extended Life Cycle 8.10 systems.
Red Hat fixed CVE-2026-23097 in Red Hat Enterprise Linux 10 kernel packages via RHSA-2026:4012. The update addressed the hugetlb folio migration deadlock flaw.
An upstream advisory posted at lore.kernel.org disclosed CVE-2026-23231, a Linux kernel netfilter nf_tables use-after-free in nf_tables_addchain(). The advisory described race conditions in both chain dumping and packet processing and the fix of adding synchronize_rcu() before chain destruction.
Red Hat issued RHSA-2026:3463 and RHSA-2026:3464 to fix CVE-2026-23097 in Red Hat Enterprise Linux 8 kernel-rt and kernel packages. These were the first fixes listed for the vulnerability.
Red Hat published the CVE-2026-23097 entry describing a Linux kernel deadlock vulnerability in hugetlb folio migration that can cause denial of service. Red Hat said no acceptable mitigation was currently available.
Red Hat issued additional fixes for CVE-2026-23097 in older supported RHEL 8 streams. RHSA-2026:26535 covered RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
Red Hat last modified its CVE-2026-43077 entry. The update followed the initial publication and listed fixed package advisories across multiple RHEL streams.
Red Hat fixed CVE-2026-23097 in Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages via RHSA-2026:15883. This expanded remediation for the vulnerability to the 10.0 EUS stream.
Red Hat published the CVE-2026-43077 entry for a Linux kernel algif_aead decryption buffer-size validation flaw. The issue was described as an incorrect minimum receive buffer size check that failed to account for the authentication tag size.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **kernel security advisories** across **RHEL 8** and **RHEL 9** product lines, covering standard, real-time, SAP, telecommunications, NFV, and extended life cycle channels. The updates address multiple high-impact flaws including `CVE-2026-23216` (use-after-free in iSCSI target code), `CVE-2026-45984` (use-after-free in the GFS2 iomap inline data write path), `CVE-2026-46189` (double free in `RDMA/vmw_pvrdma`), `CVE-2026-23191` (ALSA aloop), `CVE-2026-23401` (KVM privilege escalation or denial of service), and `CVE-2026-31431` (crypto `algif_aead`). Red Hat also disclosed broader kernel rollups for some RHEL 8.6 and 8.8 channels, including fixes for older and newer CVEs spanning NVMe, IPv6, tunneling, networking, memory corruption, overflow, and denial-of-service conditions. The advisories include **Important** and **Critical** ratings depending on the affected branch, with one RHEL 8.6 Extended Update Support and Advanced Mission Critical update fixing **16 kernel vulnerabilities**. Affected offerings include RHEL 8.6, 8.8, and 8 standard and specialized variants, plus RHEL 9.2 SAP-related builds across `x86_64`, `ppc64le`, `aarch64`, and `s390x`. Red Hat said updated kernel packages are available for each channel, noted some releases also include non-security fixes such as an `.sbat` section addition and an NFS log correction, and instructed customers to **reboot systems after applying the updates** for protections to take effect.
Aug 25, 2026
Red Hat released multiple kernel and `kernel-rt` security advisories to remediate Linux kernel vulnerabilities affecting RHEL 8, 9, and 10 product streams, including SAP, NFV, Extended Life Cycle, and Real Time variants. The updates address **CVE-2026-23097**, a hugetlb folio migration bug that can trigger a denial of service through deadlock caused by incorrect lock ordering; **CVE-2026-23193**, a use-after-free in the SCSI target iSCSI path `iscsit_dec_session_usage_count()`; and **CVE-2024-41073**, an NVMe flaw described as a double free of a special payload. Red Hat also bundled these fixes with other kernel issues such as race conditions, heap overflow, information disclosure, and local privilege escalation bugs in broader kernel update rollups. The hugetlb flaw was traced to a locking inversion between `folio_lock` and `i_mmap_rwsem`, with the fix extending `i_mmap_lock` coverage around `remove_migration_ptes()` to prevent deadlock. The iSCSI bug stemmed from calling `complete()` while `sess->session_usage_lock` remained held, allowing a waiting thread to free the session structure before the current path finished using it; the fix releases the lock before signaling completion. Red Hat published these remediations through advisories including `RHSA-2026:3463`, `RHSA-2026:6571`, `RHSA-2026:4012`, and `RHSA-2026:14301`, and said affected systems should be rebooted after applying the updated kernel packages.
Aug 25, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026