Loading story…
Red Hat released kernel security updates for RHEL 9.6 and RHEL 10.0 that address multiple vulnerabilities across NFSD, NFS, KVM on ARM64, ALSA UMP, Intel ASoC, libceph, and other kernel subsystems. RHSA-2026:0804 provides kernel 5.14.0-570.79.1.el9_6 for RHEL 9.6 support channels and is rated Important, while Moderate-rated RHSA-2026:1236 provides kernel 6.12.0-55.55.1.el10_0 for RHEL 10.0, including applicable EUS and CodeReady Linux Builder repositories across supported architectures.
The updates remediate CVE-2025-37891, an ALSA Universal MIDI Packet conversion flaw in which a four-byte buffer could receive up to six bytes of malformed SysEx data, potentially causing memory corruption; the upstream correction expands the buffer to six bytes. Red Hat also previously updated RHEL 8 kernels through RHSA-2025:21917 to fix an NFS write-update race condition, CVE-2025-39697, and an i40e driver index-validation flaw, CVE-2025-39971. Administrators should deploy the applicable kernel packages and reboot affected systems for fixes to take effect.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity RHSA-2026:1236 for RHEL 10.0, providing kernel version 6.12.0-55.55.1.el10_0. The update remediated seven CVEs, including the ALSA UMP buffer overflow CVE-2025-37891, and required a reboot for fixes to take effect.
Red Hat issued Important-rated advisory RHSA-2026:0786 for RHEL 10 kernel packages, fixing CVE-2025-68285, a potential use-after-free flaw in libceph's have_mon_and_osd_map() function. The update applies across supported RHEL 10 architectures and requires affected systems to reboot.
Red Hat issued Important-rated RHSA-2026:0804 for RHEL 9.6 support channels, delivering kernel version 5.14.0-570.79.1.el9_6. It fixed six vulnerabilities, including CVE-2025-37891 in ALSA UMP handling, and required affected systems to reboot.
Red Hat addressed the ALSA UMP SysEx-message buffer-overflow vulnerability, CVE-2025-37891, for RHEL 9.4 Extended Update Support through RHSA-2026:0917. The upstream remediation expands the affected MIDI 1.0-to-UMP conversion buffer from four to six bytes.
Red Hat issued Moderate-severity advisory RHSA-2025:21917 for RHEL 8, providing kernel version 4.18.0-553.85.1.el8_10. The update remediated CVE-2025-39697 and CVE-2025-39971; affected systems require a reboot.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for multiple RHEL 8.4, 9/9.4, and 10.0 support channels, addressing vulnerabilities in networking, NFS, USB audio, Wi-Fi, Bluetooth, storage, cryptography, EFI handling, and speculative-execution mitigations. The advisories include builds `4.18.0-305.182.1.el8_4` for RHEL 8.4 AUS and long-life systems, `5.14.0-427.100.1.el9_4` for RHEL 9.4, and `6.12.0-55.52.1.el10_0` for RHEL 10.0 Extended Update Support and related channels. Among the fixed issues is **CVE-2025-39697**, a Moderate-severity NFS write-path use-after-free race that an authenticated client with write access to an NFS export could exploit through carefully timed concurrent writes to crash the kernel, causing remote denial of service. Updates also remediate the ALSA USB-audio out-of-bounds flaw **CVE-2022-48701** and other bounds-checking, use-after-free, and protocol-handling defects; Red Hat advises customers to reboot after installation so the patched kernel is loaded. Disabling automatic loading of the NFS kernel module can reduce exposure to CVE-2025-39697 where NFS is not required.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel updates for supported **RHEL 8** and **RHEL 9** channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory. Key fixes include **CVE-2025-39751**, a buffer overflow in the ALSA HDA CA0132 driver's `add_tuning_control()` function caused by unbounded `sprintf`; **CVE-2025-39849**, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and **CVE-2022-50087**, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build `4.18.0-553.80.1.el8_10`, RHEL 8.8 SAP/TUS build `4.18.0-477.116.1.el8_8`, or RHEL 8.6 build `4.18.0-372.166.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026