Loading story…
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8.8 SAP and Telecommunications Update Services, RHEL 9 and 9.4 support channels, and RHEL 10 offerings. The advisories address memory-corruption, use-after-free, out-of-bounds read/write, integer-overflow, information-disclosure, and denial-of-service vulnerabilities that could cause service disruption or, in some cases, privilege escalation. Affected packages span x86_64, s390x, ppc64le, and aarch64 systems, including SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder channels.
Notable fixes include MPTCP use-after-free flaw CVE-2025-40133, corrected in RHEL 10 through RHSA-2026:2282, and CVE-2025-68811, an svcrdma copy-offset defect that could cause memcpy operations outside the current page and was fixed across supported RHEL 9 and 10 releases. Other patched issues include CVE-2025-68349, CVE-2026-22998, and CVE-2026-23074; RHEL 8.8 customers should deploy kernel version 4.18.0-477.130.1.el8_8. Red Hat requires systems to be rebooted after installation for the kernel fixes to take effect.
See real exploitation activity before you spend the cycle.
21 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-severity advisory RHSA-2026:3277 for RHEL 8.8 SAP Solutions and Telecommunications Update Service offerings. Kernel version 4.18.0-477.130.1.el8_8 fixes multiple flaws, including CVE-2025-38415, CVE-2025-40271, and CVE-2026-23074, and requires a reboot.
Red Hat published Moderate-severity advisory RHSA-2026:2722 for RHEL 9, fixing seven Linux kernel vulnerabilities, including CVE-2025-68349, CVE-2025-68811, and CVE-2026-22998. The affected products include multiple RHEL 9 architectures and support offerings; a reboot is required after applying the update.
Red Hat issued Moderate-severity advisory RHSA-2026:2282 for RHEL 10, addressing eight kernel vulnerabilities including CVE-2025-40133, CVE-2025-40304, CVE-2025-40322, and CVE-2025-68811. Affected offerings span RHEL 10 architectures and update-support channels, and systems must be rebooted after installation.
Red Hat published Moderate-severity advisory RHSA-2026:1444 for RHEL 9.4 support channels, fixing CVE-2023-53034, CVE-2025-37789, CVE-2025-37819, and CVE-2025-40258. The update requires a system reboot to take effect.
The Linux kernel CVE announcement for CVE-2025-68811 was published through linux-cve-announce. The svcrdma flaw could cause memcpy operations to extend outside the current page because of an incorrect offset calculation.
Red Hat issued Moderate-severity advisory RHSA-2025:21083 for RHEL 8.8 update-service variants, providing kernel version 4.18.0-477.118.1.el8_8. The update fixes 11 kernel vulnerabilities across Wi-Fi, Bluetooth, memory management, filesystems, networking, cryptography, and SCSI components, and requires a reboot.
Red Hat issued Moderate-severity advisory RHSA-2025:19886 for RHEL 9.4 lifecycle, update-support, and Extended Update Support channels. Kernel version 5.14.0-427.97.1.el9_4 fixes six vulnerabilities, including CVE-2024-46679, CVE-2025-39730, CVE-2023-53178, CVE-2023-53331, CVE-2022-50367, and CVE-2023-53401; systems require a reboot after installation.
An upstream Linux CVE announcement disclosed CVE-2023-53213, a Broadcom brcmfmac Wi-Fi driver flaw in which oversized USB-supplied association-information lengths could make kmemdup() read beyond the WL_EXTRA_BUF_MAX buffer. The upstream fix validates association-information request and response lengths before copying data.
An upstream Linux CVE advisory identified CVE-2023-53232, in which obsolete MT7921 EEPROM parsing code could access unallocated eeprom.data and trigger a NULL-pointer dereference or kernel panic. The fix removes the obsolete mt7921_mcu_parse_eeprom path and uses mt7921_mcu_parse_response for RxD-header processing.
An upstream Linux CVE announcement disclosed CVE-2023-53257, a mac80211 Wi-Fi flaw in which an S1G action code could be accessed before validating that the action frame was large enough. The upstream fix adds frame-size validation before checking the action code.
Red Hat issued Moderate-severity advisory RHSA-2025:9584 for RHEL 9.4 maintenance and support channels, providing kernel version 5.14.0-427.74.1.el9_4. The update fixes multiple vulnerabilities, including CVE-2024-26638, CVE-2024-26939, CVE-2024-35847, CVE-2024-41042, and CVE-2025-21764, and requires a reboot.
Red Hat issued Moderate-severity advisory RHSA-2025:4342 for supported RHEL 9.4 update channels, providing kernel version 5.14.0-427.66.1.el9_4. The update fixes 11 kernel CVEs, including flaws affecting USB networking, RDMA, DMA, CAN, AMDGPU, Netfilter, Wi-Fi, parallel-port, and VMCI components, and requires a reboot.
CVE-2024-26939 was reported as a use-after-free vulnerability in the Linux DRM i915 VMA code, caused by a race between VMA destruction and retirement. Upstream fixed the issue in kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2.
Red Hat reported CVE-2023-52623, a low-severity Linux SUNRPC issue involving a suspicious RCU usage warning. Upstream fixed it in kernel releases from 4.19.307 through 6.8; Fedora shipped the fix in Linux 6.7.4, and Red Hat addressed it for RHEL 8 and RHEL 9.4 EUS.
CVE-2024-26638 was reported as a low-severity Linux Network Block Device vulnerability caused by incomplete initialization of a struct msghdr object. The upstream fix fully initializes the structure; fixes were included in kernel versions 6.1.76, 6.6.15, 6.7.3, and 6.8.
Red Hat tracked CVE-2024-35944, a low-impact, pending-validation Linux VMCI issue involving a memcpy() run-time warning in dg_dispatch_as_host(). The issue was fixed in RHEL 8, RHEL 9, and RHEL 9.4 EUS through RHSA advisories including RHSA-2024:7000, RHSA-2024:7001, RHSA-2024:9315, and RHSA-2025:4342.
Red Hat documented CVE-2023-53331, in which pstore/ram initialization could accept an empty persistent RAM zone with an out-of-bounds start value, potentially causing kernel faults and panics during later writes. The fix requires an empty zone's start value to be zero; Red Hat addressed the issue in multiple RHEL 9 advisories, including RHSA-2025:19105, RHSA-2025:19886, RHSA-2025:21051, RHSA-2025:21091, RHSA-2025:21112, RHSA-2025:21128, and RHSA-2025:21136.
Red Hat documented CVE-2022-50367, a Linux NILFS filesystem flaw where failure of security_inode_alloc() can leave inode->i_private uninitialized and lead nilfs_mdt_destroy() to free it, causing use-after-free or general-protection-fault crashes. The upstream fix moves security_inode_alloc() immediately before the inode-count increment, and Red Hat addressed the issue across RHEL 7, 8, and 9 support variants.
Red Hat documented CVE-2023-53185, an ath9k Wi-Fi driver flaw in which a malicious USB device could send a service-connection response targeting reserved ENDPOINT0 and overwrite its attributes. The upstream fix rejects service-connection responses directed at ENDPOINT0; Red Hat addressed the issue in multiple RHEL 8 and 9 advisories, including RHSA-2025:21083.
Red Hat documented CVE-2023-53178, a Linux kernel zswap writeback race that can cause stale page data to be written to a reused swap offset and result in memory corruption. The fix verifies that the locally held zswap entry still matches the zswap tree entry before writeback, aborting stale operations; Red Hat shipped fixes across multiple RHEL 7, 8, and 9 support channels.
Red Hat documented CVE-2024-26669, a Linux net/sched flower classifier vulnerability involving chain-template offload handling. The upstream fix is described as “net/sched: flower: Fix chain template offload”; Fedora fixed it in Linux 6.7.3 stable updates, and Red Hat addressed it in RHEL 8, RHEL 9, and RHEL 9.4 EUS advisories.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
22 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026