Loading story…
Red Hat released kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9.6 to address multiple Linux kernel vulnerabilities, including CVE-2026-23209 in the macvlan subsystem and CVE-2026-23204 in net/sched cls_u32. The macvlan flaw stems from improper error recovery in macvlan_common_newlink(), where a failed device creation path could leave stale references in vlan_source_hash and trigger a use-after-free when packets are later processed. The cls_u32 flaw was caused by skb_header_pointer() not fully validating negative offsets, creating a slab out-of-bounds condition in u32_classify().
Upstream fixes changed the affected code paths by ensuring macvlan_flush_sources() runs on the relevant error path and by replacing skb_header_pointer() with skb_header_pointer_careful(). Red Hat published the fixes through advisories including RHSA-2026:6037, RHSA-2026:6036, and RHSA-2026:6164, covering multiple architectures and support channels such as Extended Life Cycle, CodeReady Linux Builder, and real-time offerings. Red Hat rated the updates Moderate and said affected systems must be rebooted after patching for the kernel fixes to take effect.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:9515 for RHEL 8.8 update service variants, delivering a kernel update that fixes CVE-2026-23204 in net/sched cls_u32. The advisory also addressed CVE-2026-23231 in nf_tables_addchain() and instructed customers to reboot after applying the update.
Red Hat published RHSA-2026:6953 for RHEL Server Advanced Update Support 8.2 on x86_64, delivering kernel version 4.18.0-193.193.1.el8_2 with a fix for CVE-2026-23209 in macvlan_common_newlink(). The update also addressed CVE-2022-49674, CVE-2025-38180, and CVE-2021-4460; affected systems require a reboot.
Red Hat published RHSA-2026:6692 for RHEL 10.0, delivering kernel version 6.12.0-55.66.1.el10_0. The update fixes the svcrdma memcpy byte-offset flaw CVE-2025-68811 and the macvlan error-recovery flaw CVE-2026-23209; affected systems require a reboot.
Red Hat published RHSA-2026:6164 for Red Hat Enterprise Linux 9.6 Extended Update Support channels, including a fix for CVE-2026-23209 in macvlan_common_newlink(). The advisory also addressed three other kernel vulnerabilities and instructed customers to reboot after applying the update.
Red Hat published RHSA-2026:6036 and RHSA-2026:6037 to deliver kernel-rt and kernel updates for Red Hat Enterprise Linux 8, fixing CVE-2026-23204 and CVE-2026-23209 along with CVE-2025-38180. The advisories cover RHEL 8 real-time and standard product streams and require a reboot after installation.
An upstream Linux kernel advisory for CVE-2026-23204 was published, documenting the net/sched cls_u32 flaw caused by insufficient validation of negative offset values in skb_header_pointer(). The fix replaced skb_header_pointer() with skb_header_pointer_careful().
An upstream Linux kernel advisory disclosed CVE-2025-38180, a use-after-free vulnerability in /proc/net/atm/lec handling. Unsafe dev_lec[] changes could allow dev_put() without a preceding dev_hold(), creating a reference-count imbalance.
Red Hat addressed the dm-raid out-of-bounds vulnerability CVE-2022-49674 in RHSA-2026:6961 for specified RHEL 8.6 service variants and RHSA-2026:7003 for specified RHEL 8.4 extended-support variants. The flaw could access beyond the allocated rs->devs RAID-member array during RAID layout changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a series of **Moderate-severity** kernel and `kernel-rt` security advisories across multiple Red Hat Enterprise Linux product lines, including RHEL 9.0, 9.2, 9.4 EUS, 9.6 EUS, RHEL 10, RHEL 10.0 EUS, and RHEL 7 ELS. The updates address several Linux kernel vulnerabilities tied to **use-after-free**, **double-free**, **memory leak**, **race condition**, **denial-of-service**, and **privilege-escalation** conditions. Repeatedly cited issues include `CVE-2026-23171` in the bonding module, which can cause a system crash or arbitrary code execution, `CVE-2026-23231` in `nf_tables_addchain()`, which can enable privilege escalation or denial of service, and `CVE-2026-23204` in `net/sched cls_u32`. Red Hat also highlighted `CVE-2026-23001`, a macvlan use-after-free in `macvlan_forward_source()`, with Bugzilla detailing an upstream fix that adds **RCU protection** so entries queued for freeing are skipped safely. That flaw, along with related macvlan issues such as `CVE-2026-23209`, was included in updates for several RHEL branches and SAP-related offerings. Advisories consistently state that affected systems must be **rebooted** after applying the updated kernel packages for the fixes to take effect.
Sep 4, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026