Loading story…
Red Hat released RHSA-2025:21931 kernel updates for Red Hat Enterprise Linux 10 that remediate CVE-2025-39955, a TCP Fast Open (TFO) state-management flaw. The vulnerability occurs when a server-side TFO socket is reused as a client before its prior TFO operation completes, potentially leaving tcp_sk(sk)->fastopen_rsk referencing a freed request_sock; a retransmission timer may then access the stale object, causing a kernel warning and potentially enabling use-after-free or information-disclosure conditions.
Red Hat rates the issue Moderate severity with a CVSS v3.1 score of 7.6 and notes that exploitation requires local access and the ability to create and manipulate TFO sockets, typically in privileged or test environments. The advisory updates RHEL 10 kernels for x86_64, s390x, ppc64le, and aarch64, including applicable extended-support variants; it also fixes the NFS filehandle bounds-checking vulnerability CVE-2025-39730. Organizations should apply the updated kernel packages and reboot affected hosts.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:23422, an Important update providing kernel-rt 5.14.0-284.150.1.rt14.435.el9_2 for RHEL 9.2 SAP Solutions and Extended Life Cycle subscriptions. The update fixes CVE-2025-39955 along with CVE-2023-53322, CVE-2025-39864, and CVE-2025-40186; affected systems require a reboot.
Red Hat issued RHSA-2025:21931 for RHEL 10 kernel packages, fixing CVE-2025-39955 and CVE-2025-39730. Systems require a reboot after installation for the kernel fixes to take effect.
The CVE record for CVE-2025-39955, a Linux kernel TCP Fast Open stale-reference flaw, was publicly listed.
An upstream Linux CVE announcement disclosed CVE-2025-39864, a use-after-free vulnerability in the cfg80211 Wi-Fi subsystem's handling of hidden-SSID beacon BSS entries. The upstream fix changes cfg80211_update_known_bss() to avoid freeing beacon-frame elements shared through hidden_beacon_bss.
Red Hat released RHSA-2025:23947 and RHSA-2025:23960 with fixed kernel and kernel-rt packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat released RHSA-2025:23445, RHSA-2025:23463, and RHSA-2025:23425, supplying fixed kernel packages for RHEL 8.2 Advanced Update Support, RHEL 8.4 mission-critical and extended-support variants, and RHEL 8.6 Advanced Mission Critical Update Support.
Red Hat released RHSA-2025:22571 with fixed kernel packages for Red Hat Enterprise Linux 10.0 Extended Update Support.
Red Hat released RHSA-2025:22388 and RHSA-2025:22387, providing fixed kernel and kernel-rt packages for Red Hat Enterprise Linux 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated kernel updates for specialized RHEL 8.8 and RHEL 9.2 support channels, addressing TCP Fast Open (TFO) flaws including **CVE-2025-40186**. A low-privileged local attacker could close a listener while `tcp_conn_request()` processes a TFO socket, triggering use-after-free and double-free conditions that may cause a kernel panic or potentially enable privilege escalation. The RHEL 8.8 update also fixes **CVE-2025-39955** and the memory-management race condition tracked as **CVE-2023-53401**; the RHEL 9.2 update additionally remediates qla2xxx driver flaw **CVE-2023-53322** and cfg80211 Wi-Fi flaw **CVE-2025-39864**. Affected deployments include RHEL 8.8 Extended Life Cycle Long Life, TUS, and SAP update channels on x86_64 and Power LE, and RHEL 9.2 AUS, SAP, four-year update, and Extended Life Cycle offerings across x86_64, ARM64, IBM Z, and Power LE. Red Hat supplied fixed kernel builds `4.18.0-477.123.1.el8_8` for the covered RHEL 8.8 channels and `5.14.0-284.150.1.el9_2` for RHEL 9.2; administrators should install the applicable packages and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Important-security-impact kernel updates for RHEL 9.0 Update Services for SAP Solutions, addressing five kernel vulnerabilities in the qla2xxx SCSI driver, TCP Fast Open (TFO), cfg80211 Wi-Fi handling, and Network Block Device ioctl validation. The updates include `CVE-2023-53322`, a qla2xxx use-after-free condition in which `terminate_rport_io()` may return before outstanding FCP-2 I/O completes, potentially causing a system crash, and `CVE-2025-40186`, a TFO request-path refcount underflow/use-after-free caused by duplicate removal of a request socket while a listening socket is closed. RHSA-2025:23424 supplies `kernel-rt-5.14.0-70.158.1.rt21.230.el9_0` for x86_64 RHEL 9.0 SAP Solutions real-time deployments, while RHSA-2025:23426 provides `kernel-5.14.0-70.158.1.el9_0` for affected x86_64, ppc64le, and specified aarch64 and s390x offerings. Organizations should install the applicable kernel packages and reboot affected systems to activate the fixes; no qualifying mitigation was listed for `CVE-2023-53322`.
Aug 26, 2026
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026