Loading story…
Red Hat released multiple kernel and kernel-rt security advisories to remediate Linux kernel vulnerabilities affecting RHEL 8, 9, and 10 product streams, including SAP, NFV, Extended Life Cycle, and Real Time variants. The updates address CVE-2026-23097, a hugetlb folio migration bug that can trigger a denial of service through deadlock caused by incorrect lock ordering; CVE-2026-23193, a use-after-free in the SCSI target iSCSI path iscsit_dec_session_usage_count(); and CVE-2024-41073, an NVMe flaw described as a double free of a special payload. Red Hat also bundled these fixes with other kernel issues such as race conditions, heap overflow, information disclosure, and local privilege escalation bugs in broader kernel update rollups.
The hugetlb flaw was traced to a locking inversion between folio_lock and i_mmap_rwsem, with the fix extending i_mmap_lock coverage around remove_migration_ptes() to prevent deadlock. The iSCSI bug stemmed from calling complete() while sess->session_usage_lock remained held, allowing a waiting thread to free the session structure before the current path finished using it; the fix releases the lock before signaling completion. Red Hat published these remediations through advisories including RHSA-2026:3463, RHSA-2026:6571, RHSA-2026:4012, and RHSA-2026:14301, and said affected systems should be rebooted after applying the updated kernel packages.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:14301 for RHEL 9.2 Update Services for SAP Solutions and RHEL 9.2 Extended Life Cycle, fixing multiple kernel flaws. The advisory includes fixes for CVE-2024-41073, CVE-2026-23097, and CVE-2026-23193 among other vulnerabilities.
Red Hat published RHSA-2026:6571 for Red Hat Enterprise Linux 8, including a fix for CVE-2026-23193 in the kernel SCSI target iSCSI code. The advisory identifies the flaw as a use-after-free in iscsit_dec_session_usage_count().
Red Hat published RHSA-2026:4012, a kernel security update for Red Hat Enterprise Linux 10 that included a fix for CVE-2026-23097. The advisory lists the issue among multiple kernel vulnerabilities remediated in the update.
Red Hat published RHSA-2026:3464 for Red Hat Enterprise Linux 8, providing a kernel security update that fixes CVE-2026-23097. The advisory describes the flaw as a denial-of-service issue caused by a deadlock in hugetlb folio migration and shipped updated kernel packages version 4.18.0-553.109.1.el8_10.
Red Hat published RHSA-2026:3463 to fix CVE-2026-23097 in kernel-rt packages for Red Hat Enterprise Linux 8. The advisory describes the flaw as a denial-of-service issue caused by a deadlock in hugetlb folio migration.
An upstream advisory for CVE-2026-23193 was published on lore.kernel.org for the Linux kernel iSCSI use-after-free flaw in iscsit_dec_session_usage_count(). The bug involved calling complete() while sess->session_usage_lock was still held, enabling a race to free the session structure too early.
Mauro Matteo Cascella reported Red Hat bug 2301637 for the Linux kernel NVMe vulnerability later assigned CVE-2024-41073. The issue was described as "nvme: avoid double free special payload."
Red Hat states CVE-2024-41073 was addressed in Red Hat Enterprise Linux 9 via advisory RHSA-2024:6567. The references do not provide the publication date of that advisory.
The CVE-2024-41073 bug record states the vulnerability was resolved upstream in Linux kernel versions 5.15.164, 6.1.101, 6.6.42, 6.9.11, and 6.10. No explicit release date for those upstream fixes is provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **kernel security advisories** for Red Hat Enterprise Linux 8, 9, and 10 channels to address several Linux kernel vulnerabilities, including **CVE-2026-23097**, **CVE-2026-23193**, **CVE-2026-31402**, **CVE-2026-31431**, and **CVE-2026-43077**. The flaws span a hugetlb folio migration deadlock that can trigger system hangs and denial of service, a use-after-free in iSCSI target code, a `qla2xxx` double-free that may enable denial of service or privilege escalation, a heap overflow in the NFSv4.0 LOCK replay cache, and a crypto `algif_aead` buffer-size validation issue that could lead to crashes, memory corruption, memory disclosure, or possible code execution in some contexts. The updates were published through advisories including **RHSA-2026:11313**, **RHSA-2026:13664**, **RHSA-2026:13681**, **RHSA-2026:13887**, and **RHSA-2026:14165**, covering product variants such as RHEL 8.4, 8.6, 8.8, 9.6, and 10.0 support channels. Red Hat rated several of the kernel updates as **Important** and noted that no acceptable mitigation was available for the hugetlb deadlock issue; affected systems require installation of the updated kernel packages and a **reboot** for protections to take effect.
Aug 25, 2026
Red Hat released multiple kernel security advisories for **Red Hat Enterprise Linux 8** and **RHEL 9.2** variants, including Update Services for SAP Solutions and Extended Life Cycle channels, to address a set of Linux kernel vulnerabilities affecting locking, virtualization, and networking code. The updates remediate five flaws in the RHEL 9.2 packages—`CVE-2026-43027`, `CVE-2026-43499`, `CVE-2026-46113`, `CVE-2026-53166`, and `CVE-2026-53359`—covering issues in **netfilter**, **rtmutex**, **futex/requeue**, and two **KVM x86 shadow paging** use-after-free conditions. A separate RHEL 8 advisory fixes eight kernel vulnerabilities spanning **net/sched**, **IOMMU**, **ATM networking**, **rtmutex**, **futex**, **KVM x86 shadow paging**, and **netfilter ebtables**. One of the patched bugs, `CVE-2026-53166`, is a moderate-severity flaw in the futex requeue mechanism that can trigger a **NULL pointer dereference** and crash the kernel during a self-deadlock scenario, resulting in local denial of service. Red Hat grouped that issue with `CVE-2026-43499` in its **"GhostLock"** bulletin, warning that the affected futex priority-inheritance code is built into standard RHEL kernels and that no runtime mitigation is available. The company urged customers to install the updated kernel packages and **reboot** affected systems for the fixes to take effect.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026