Loading story…
Red Hat released Moderate-severity Linux kernel security updates across RHEL 8, RHEL 9 SAP Solutions, and RHEL 10. The fixes address vulnerabilities in Bluetooth key and L2CAP handling, Wi-Fi cfg80211 connection-result processing, NFS, virtio-vsock, swap management, ALSA, efivarfs, and the lpfc Fibre Channel driver. Bluetooth fixes include CVE-2023-53386, a potential use-after-free triggered while clearing keys after an object has been queued for deferred kfree_rcu() release.
Affected organizations should install the applicable kernel builds, including 4.18.0-553.81.1.el8_10 for RHEL 8.10 variants, 4.18.0-372.168.1.el8_6 for supported RHEL 8.6 service variants, and 5.14.0-70.157.1.el9_0 for RHEL 9.0 SAP Solutions. The RHEL 9 SAP update also fixes an act_ct fragment-handling flaw that can leak sk_buffs and crash systems, an lpfc buffer-lifecycle issue, and a memory-failure assertion bug. Red Hat requires a system reboot after installation for the kernel fixes to take effect.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2025:22661 for RHEL 9.4 support channels, providing kernel version 5.14.0-427.102.1.el9_4. The update fixes CVE-2025-39841 in the SCSI lpfc deferred receive path and CVE-2025-39883 in memory-failure unpoisoning code; affected systems require a reboot.
Red Hat issued Moderate-severity advisory RHSA-2025:19102 for RHEL 8, providing kernel version 4.18.0-553.81.1.el8_10 and fixing CVE-2023-53386 along with other kernel flaws. Systems must be rebooted after installation.
The upstream Linux kernel resolved CVE-2025-39727, a potential buffer overflow in the swap subsystem's setup_clusters() when a validated badpage is greater than or equal to maxpages. Red Hat addressed the flaw for RHEL 10 through RHSA-2025:19106 and RHSA-2025:21118.
Red Hat issued Moderate-severity RHSA-2025:21084 for supported RHEL 8.6 service variants, including a fix for CVE-2023-53386. The update provides kernel version 4.18.0-372.168.1.el8_6 and requires a reboot to take effect.
The Linux kernel fixed CVE-2023-53386, a potential Bluetooth use-after-free during key-clearing operations caused by accessing a key after it was scheduled for deferred release with kfree_rcu().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity Linux kernel updates for supported **RHEL 8** and **RHEL 9** channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory. Key fixes include **CVE-2025-39751**, a buffer overflow in the ALSA HDA CA0132 driver's `add_tuning_control()` function caused by unbounded `sprintf`; **CVE-2025-39849**, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and **CVE-2022-50087**, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build `4.18.0-553.80.1.el8_10`, RHEL 8.8 SAP/TUS build `4.18.0-477.116.1.el8_8`, or RHEL 8.6 build `4.18.0-372.166.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Moderate- and Important-severity Linux kernel security updates across RHEL 8 and RHEL 9 support channels, including Real Time, NFV, SAP Solutions, Extended Life Cycle, Extended Update Support, and Application Update Services offerings. The advisories address vulnerabilities in NFS server processing, SMB/CIFS rename handling, memory-failure recovery, TCP Fast Open, Wi-Fi, Bluetooth, USB audio, EFI variables, SCTP, IPv6 routing, ext4, and network drivers. Updated packages include `4.18.0-553.87.1.el8_10` for RHEL 8.10, `4.18.0-477.120.1.el8_8` for selected RHEL 8.8 channels, `5.14.0-284.148.1.el9_2` for RHEL 9.2 SAP-related channels, and `5.14.0-570.69.1.el9_6` for RHEL 9.6. The updates include a fix for **CVE-2023-53513**, an NBD `nbd_ioctl` validation flaw in which an oversized ioctl argument could cause signed integer overflow during block-write processing and unexpected behavior when narrowed on 64-bit systems. Red Hat also shipped the corresponding real-time kernel build, `4.18.0-553.87.1.rt7.428.el8_10`, for affected RHEL 8 real-time deployments. Organizations should apply the appropriate kernel packages for their subscribed architecture and support channel, then reboot systems to activate the fixes; the advisories do not state that the listed issues are under active exploitation.
Aug 28, 2026
Red Hat released Important-rated Linux kernel updates for RHEL 7 Extended Life Cycle Support, RHEL 8.2 Advanced Update Support, and RHEL 9.0 Update Services for SAP Solutions, including corresponding Real Time kernel packages. The advisories remediate multiple kernel memory-safety and scheduler defects, notably **CVE-2025-38250**, a use-after-free race in the Bluetooth Virtual HCI driver's `vhci_flush()` path, and **CVE-2025-38177**, an unsafe HFSC traffic-control queue notification flaw that could cause repeated state updates and unsafe RB-tree removal. The updates also address double-free, use-after-free, information-disclosure, NFS, ext4, ftrace, AMD TEE, QRTR, and network-scheduler issues, plus **CVE-2022-49991**, in which hugetlb atomic-copy handling could corrupt `page->mapping`. Updated packages include `kernel-3.10.0-1160.137.1.el7` for RHEL 7 ELS, `kernel-4.18.0-193.165.1.el8_2` for RHEL 8.2 AUS, `kernel-rt-3.10.0-1160.137.1.rt56.1289.el7` for RHEL 7 Real Time ELS, and `kernel-rt-5.14.0-70.144.1.rt21.216.el9_0` for RHEL 9 SAP systems; administrators must reboot after installation for the fixes to take effect.
Aug 26, 2026