Loading story…
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems.
Among the corrected issues is CVE-2025-21999, a race condition in proc_get_inode() that could cause a use-after-free during concurrent /proc inode creation and kernel-module removal. The flaw relies on delete_module, requiring CAP_SYS_MODULE, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
See real exploitation activity before you spend the cycle.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important security advisory RHSA-2025:9080 for RHEL 9, including a fix for the proc_get_inode() use-after-free tracked as CVE-2025-21999. Red Hat instructed customers to reboot after applying the kernel update for the fixes to take effect.
Red Hat issued Moderate-severity advisory RHSA-2025:6966 for an updated RHEL 9 kernel, remediating a large set of Linux-kernel vulnerabilities across Bluetooth, networking, filesystems, BPF, drivers, and virtualization. The update includes CVE-2025-1272, involving Secure Boot not automatically enabling kernel lockdown, and requires a reboot after installation.
Eric Sandeen questioned the vulnerability's privilege-requirement scoring, noting that exploiting the race depends on delete_module, which requires CAP_SYS_MODULE privileges.
An upstream advisory identified a Linux kernel use-after-free vulnerability in proc_get_inode(), caused by a race between module removal and /proc inode instantiation. The flaw could dereference module-owned proc_ops after the module had been freed.
Red Hat issued RHBA-2024:11008 to update the integration/camel-k-rhel8-operator-bundle image for RHEL 8-based Middleware Containers, including affected OpenShift Container Platform 4.11 and 4.12 deployments. The update incorporates fixes for multiple Linux kernel vulnerabilities and advises customers to upgrade the image and rebuild dependent images.
Red Hat issued Moderate-security advisory RHSA-2024:10943 for RHEL 8, providing kernel version 4.18.0-553.32.1.el8_10. The update fixes nine vulnerabilities affecting SELinux/SMACK permissions, networking, storage QoS, ARM64 probes, XFRM/IPsec, interrupt virtualization, IPv6 netfilter, and virtio-vsock; systems must be rebooted after installation.
Red Hat issued Moderate-security advisory RHSA-2024:10281 for RHEL 8, updating kernel:4.18.0 to build 4.18.0-553.30.1.el8_10. The update remediates CVE-2024-27043, CVE-2024-27399, CVE-2024-38564, and CVE-2024-46858; affected systems require a reboot after installation.
Red Hat reported CVE-2024-50264 in Linux virtio-vsock, where loopback communication can leave a dangling pointer in vsk->trans and potentially cause a use-after-free. The upstream fix initializes vsk->trans to NULL; Red Hat remediated the issue through RHEL 8, RHEL 9, and RHEL 9.4 EUS advisories.
Red Hat reported and began tracking CVE-2024-27399 as Bugzilla 2280462. The Linux Bluetooth L2CAP flaw is a null-pointer dereference in l2cap_chan_timeout, with an upstream fix included in Linux kernel 6.9.
Red Hat documented CVE-2024-50256, in which nf_send_reset6() can trigger an skb_under_panic kernel crash when a device has a zero hard_header_len and an Ethernet header is pushed. The fix reserves link-layer header space with LL_MAX_HEADER and was distributed through RHEL 8, RHEL 9, and RHEL 9.4 EUS advisories.
Red Hat documented CVE-2024-38564 as a missing BPF_PROG_TYPE_CGROUP_SKB attach-type enforcement issue in BPF_LINK_CREATE. Fixes were distributed through additional RHEL 8 and RHEL 9 advisories, including EUS and specialized support channels.
Red Hat documented CVE-2024-49949, in which malformed userspace-controlled UDP fragmentation offload traffic can cause qdisc_pkt_len_init() to calculate zero GSO segments and trigger a NULL-pointer dereference in FQ-CoDel. The kernel denial-of-service issue was addressed through RHEL 8, RHEL 9, and RHEL 9.4 EUS advisories, including RHSA-2024:10944, RHSA-2024:10939, RHSA-2024:10943, and RHSA-2025:2270.
Red Hat addressed CVE-2024-46858, a Linux MPTCP path-manager use-after-free involving concurrent packet processing and Netlink address flushing, through advisories covering multiple RHEL 8 and RHEL 9 support channels. The fix retains the timer reference while holding pm.lock and moves address-list deletion into mptcp_pm_del_add_timer under that lock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
16 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026