Loading story…
Red Hat released Important-rated kernel security updates across Red Hat Enterprise Linux (RHEL) 8, 9, and 10, addressing flaws in USB, graphics, networking, storage, Bluetooth, and virtualization-related components. Among the remediated issues are CVE-2025-68287, a use-after-free race in the DWC3 USB gadget driver that can occur during concurrent request removal, and CVE-2025-40277, in which inadequate validation of VMware SVGA (drm/vmwgfx) command-header sizes can permit integer overflow and out-of-bounds memory access from user-controlled data.
RHEL 9 advisory RHSA-2026:0793 fixes the DWC3 and vmwgfx defects alongside vulnerabilities in DRM/Xe, SMB client handling, and libceph; RHEL 8 updates also address vmwgfx, vsock memory corruption, IPv6 out-of-bounds access, and other subsystem flaws for supported AUS, EUS, real-time, NFV, SAP, and lifecycle variants. RHEL 10 kernel updates remediate DRM/Xe, Bluetooth ISO, TLS, and libceph issues. Organizations should install the applicable updated kernel packages through their supported RHEL repositories and reboot affected systems to activate the fixes.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-security advisory RHSA-2026:0917 for RHEL 9.4 servicing channels, providing kernel version 5.14.0-427.107.1.el9_4. The update fixes CVE-2025-40277 and four additional kernel flaws involving iommufd, KVM arm64, ALSA UMP, and the ASoC bytcr_rt5640 driver.
Red Hat issued an Important kernel update for RHEL 10.0, fixing vulnerabilities in drm/xe, Bluetooth ISO, TLS message handling, and libceph, including the potential libceph use-after-free CVE-2025-68285.
An upstream Linux CVE announcement referenced CVE-2025-40277, involving insufficient validation of userspace-controlled command-header sizes in the drm/vmwgfx VMware SVGA driver.
An upstream Linux CVE announcement referenced CVE-2025-37849, a KVM arm64 flaw where failed vCPU creation could leave vGIC vCPU data initialized, causing a memory leak or potential use-after-free. The upstream fix destroys the vGIC vCPU structures on the failure path.
Red Hat issued an Important kernel update for selected RHEL 8.6 AUS, TUS, Extended Life Cycle Long Life, and SAP support variants. The update remediates CVE-2025-40277 and flaws in mac80211, media remote-control handling, IPv6, and vsock.
Red Hat issued an Important security update for RHEL Server AUS 8.2 on x86_64. It fixes CVE-2025-40277 and five additional kernel vulnerabilities affecting e1000e, media remote-control handling, IPv6 parsing, vsock, and Bluetooth L2CAP.
Red Hat issued an Important kernel-rt update for RHEL 8 Real Time, Real Time for NFV, and Extended Life Cycle 8.10 systems. The update fixes CVE-2025-40277 along with Bluetooth, ASoC, and vsock kernel vulnerabilities.
Red Hat addressed CVE-2025-21724, an iommufd/iova_bitmap shift-out-of-bounds flaw, for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions through RHSA-2026:1441 and RHSA-2026:1443. The upstream fix changes a shifted constant from "1" to "1UL" to prevent undefined shifts at page-shift values above 31.
Red Hat issued an Important kernel security update for RHEL 9 that fixes CVE-2025-40277 in drm/vmwgfx and CVE-2025-68287, a DWC3 USB request-removal race that can cause a use-after-free crash. The advisory also remediates DRM/Xe, SMB client, and libceph flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026