Loading story…
Red Hat issued fixes for two Linux kernel vulnerabilities affecting supported Red Hat Enterprise Linux update streams. CVE-2023-52638 affects the CAN J1939 networking subsystem, where contention involving j1939_socks_lock can trigger a deadlock; the upstream remediation replaces the lock with a read-write lock. Red Hat delivered advisories for RHEL 9, RHEL 9.2 Extended Update Support, and RHEL 9.0 Update Services for SAP Solutions.
CVE-2023-53705 affects IPv6 packet-option parsing in ipv6_find_tlv(). The function can read an option-length value without first verifying that at least two bytes remain, creating an out-of-bounds memory-access condition. The flaw, identified by InfoTeCS on behalf of the Linux Verification Center using SVACE, was addressed through RHSA updates for supported RHEL 7, 8, and 9 update-service variants.
See real exploitation activity before you spend the cycle.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Important-rated RHSA-2026:0536 for selected RHEL 8.6 support channels, providing kernel 4.18.0-372.175.1.el8_6. The update fixes CVE-2023-53675 and CVE-2023-53680 along with additional vulnerabilities affecting SMB/CIFS, SCSI, memory management, NBD, RDMA/rxe, network drivers, and Ceph; affected systems require a reboot after installation.
Red Hat issued advisories addressing CVE-2023-53705 for supported RHEL 7, 8, and 9 update-service variants, including RHEL 9.0 SAP Solutions, RHEL 8.4 mission-critical and EUS offerings, RHEL 8.8 SAP and telecommunications services, and RHEL 7 Extended Lifecycle Support.
Red Hat issued January 2026 advisories addressing CVE-2023-53675, a possible desc_ptr out-of-bounds access in the Linux kernel SCSI SES ses_enclosure_data_process() function. The advisories cover specialized RHEL 7, 8, and 9 update-service offerings, including RHSA-2026:0532 through RHSA-2026:0537, RHSA-2026:0643, RHSA-2026:0754, and RHSA-2026:0755.
Red Hat issued Moderate-severity RHSA-2025:22006 for supported RHEL 8.6 service variants, providing kernel 4.18.0-372.170.1.el8_6 for x86_64 and certain SAP Solutions deployments on ppc64le. The update fixes 18 CVEs, including CVE-2023-53365, and requires systems to reboot after installation.
Red Hat issued Moderate-severity RHSA-2025:22087 for the Real Time Linux Kernel on RHEL 9.0 Update Services for SAP Solutions x86_64 systems. The update provides kernel-rt 5.14.0-70.155.1.rt21.227.el9_0, remediates nine kernel CVEs including CVE-2023-53365, and requires a reboot after installation.
Red Hat issued Moderate-severity RHSA-2025:22066 for RHEL 9.0 Update Services for SAP Solutions, providing kernel 5.14.0-70.155.1.el9_0 for x86_64, ppc64le, aarch64, and s390x. The update fixes nine CVEs, including CVE-2023-53365, and requires affected systems to reboot after installation.
An upstream Linux CVE announcement was published for CVE-2023-53705, covering the IPv6 ipv6_find_tlv() out-of-bounds access issue.
An upstream Linux CVE announcement referenced CVE-2023-53680, an NFSD flaw in which nfsd4_decode_compound() could pass OP_ILLEGAL (10044) to OPDESC(), causing an out-of-bounds access to the nfsd4_ops[] array.
An upstream Linux CVE announcement referenced CVE-2023-53365, an IPv6 multicast-routing flaw in ip6mr_cache_report() that can pass a negative network offset to skb_push(), causing unsigned underflow, skb_under_panic, and a kernel crash under an affected VLAN-on-pim6reg configuration.
Red Hat issued Important-rated RHSA-2025:14692 for selected RHEL 8.6 extended-support and update-service offerings, providing kernel 4.18.0-372.158.1.el8_6. The update fixes nine vulnerabilities, including CAN, HFSC networking, cryptographic, ftrace, and Bluetooth flaws, and requires a reboot after installation.
Red Hat Bugzilla records CVE-2025-39898, a Linux kernel e1000e issue described as a heap overflow in the e1000_set_eeprom function.
InfoTeCS, acting for the Linux Verification Center, identified an out-of-bounds access vulnerability in the Linux kernel ipv6_find_tlv() function using the SVACE analysis tool. The flaw results from reading optlen without ensuring that more than one byte remains to parse.
Red Hat addressed CVE-2023-52638 in advisories for RHEL 9, RHEL 9.2 Extended Update Support, and RHEL 9.0 Update Services for SAP Solutions, including RHSA-2024:4533, RHSA-2024:4554, RHSA-2024:4583, RHSA-2026:0537, and RHSA-2026:0576.
The Linux kernel CVE team assigned CVE-2023-52638 for a CAN J1939 subsystem flaw that could deadlock on j1939_socks_lock. The upstream fix replaced the lock with a read-write lock to prevent the deadlock.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
14 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released multiple **kernel security advisories** across RHEL 8, 9, and 10 product streams to remediate a set of Linux kernel vulnerabilities affecting core subsystems including **CAN raw sockets**, **RDMA/umad**, and the **qla2xxx** SCSI driver. The updates span standard, real-time, Extended Update Support, Extended Life Cycle, SAP, Telecommunications, and mission-critical channels, with advisories including `RHSA-2026:13932`, `RHSA-2026:18134`, `RHSA-2026:19521`, `RHSA-2026:19875`, `RHSA-2026:20130`, and `RHSA-2026:27353`. Red Hat rated several of the releases **Important** and said affected systems must be **rebooted** after installation for the fixes to take effect. Among the patched issues, **CVE-2026-31532** fixes a use-after-free in `net/can/raw.c` where `raw_rcv()` could access freed `ro->uniq` memory during deferred receiver deletion, while **CVE-2026-23243** addresses an RDMA `umad` flaw in `ib_umad_write()` that could turn a negative `data_len` into memory corruption through an out-of-bounds `memset`. Red Hat advisories also include **CVE-2025-71238**, a double-free bug in `qla2xxx` BSG request handling that can crash the kernel and may enable privilege escalation, alongside other kernel flaws such as local privilege escalation, denial of service, and unauthorized file reads. Upstream Linux kernel guidance for the CAN issue points administrators to updated stable kernel releases rather than cherry-picking individual commits.
Aug 25, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released multiple kernel and `kernel-rt` security advisories to remediate Linux kernel vulnerabilities affecting RHEL 8, 9, and 10 product streams, including SAP, NFV, Extended Life Cycle, and Real Time variants. The updates address **CVE-2026-23097**, a hugetlb folio migration bug that can trigger a denial of service through deadlock caused by incorrect lock ordering; **CVE-2026-23193**, a use-after-free in the SCSI target iSCSI path `iscsit_dec_session_usage_count()`; and **CVE-2024-41073**, an NVMe flaw described as a double free of a special payload. Red Hat also bundled these fixes with other kernel issues such as race conditions, heap overflow, information disclosure, and local privilege escalation bugs in broader kernel update rollups. The hugetlb flaw was traced to a locking inversion between `folio_lock` and `i_mmap_rwsem`, with the fix extending `i_mmap_lock` coverage around `remove_migration_ptes()` to prevent deadlock. The iSCSI bug stemmed from calling `complete()` while `sess->session_usage_lock` remained held, allowing a waiting thread to free the session structure before the current path finished using it; the fix releases the lock before signaling completion. Red Hat published these remediations through advisories including `RHSA-2026:3463`, `RHSA-2026:6571`, `RHSA-2026:4012`, and `RHSA-2026:14301`, and said affected systems should be rebooted after applying the updated kernel packages.
Aug 25, 2026