Loading story…
Red Hat released Moderate-severity Linux kernel security updates for RHEL 8, RHEL 9, and RHEL 10, addressing vulnerabilities that include use-after-free conditions, an x86 VMSCAPE issue, and an IPv6 Segment Routing MAC-comparison timing flaw. RHEL 10 advisory RHSA-2025:19469 fixes CVE-2025-39702 and the kernfs polling use-after-free CVE-2025-39881; RHEL 9 advisory RHSA-2025:19409 fixes CVE-2025-39702, the NILFS use-after-free CVE-2022-50367, and XTS crypto request handling flaw CVE-2023-53494.
RHEL 8 advisories RHSA-2025:19931 and RHSA-2025:19932 update standard and real-time kernels to address CVE-2025-40300 through conditional IBPB mitigation, the zswap writeback race CVE-2023-53178, and CVE-2022-50367. The updates span x86_64, IBM Z, Power, and ARM64 offerings where applicable, including selected CodeReady Builder, EUS, ELC, SAP, NFV, and Real Time repositories. Red Hat requires systems to be rebooted after installing the updated kernel packages for mitigations and fixes to take effect.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:19932, a Moderate-severity update for RHEL 8 kernel-rt packages, including Real Time and Real Time for NFV offerings. Kernel-rt build 4.18.0-553.83.1.rt7.424.el8_10 fixes CVE-2025-40300, CVE-2023-53178, and CVE-2022-50367, with a reboot required.
Red Hat issued RHSA-2025:19931, a Moderate-severity RHEL 8 kernel update providing build 4.18.0-553.83.1.el8_10. It fixes CVE-2025-40300, CVE-2023-53178, and CVE-2022-50367; affected systems must be rebooted.
Red Hat issued RHSA-2025:19469, a Moderate-severity RHEL 10 kernel update addressing CVE-2025-39702, a non-constant-time IPv6 Segment Routing MAC comparison, and CVE-2025-39881, a kernfs polling use-after-free. A reboot is required for the update to take effect.
Red Hat published RHSA-2025:19409, a Moderate-severity RHEL 9 kernel update fixing CVE-2023-53494, CVE-2025-39702, and CVE-2022-50367. The advisory covers multiple RHEL 9 architectures and update-service variants and requires a reboot after installation.
An upstream CVE announcement for CVE-2023-53494 was referenced. The Linux kernel XTS cryptography flaw could cause a use-after-free when an EBUSY result for a backlogged request was not handled like EINPROGRESS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026