Loading story…
Red Hat released Moderate-severity Linux kernel updates for supported RHEL 8 and RHEL 9 channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory.
Key fixes include CVE-2025-39751, a buffer overflow in the ALSA HDA CA0132 driver's add_tuning_control() function caused by unbounded sprintf; CVE-2025-39849, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and CVE-2022-50087, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build 4.18.0-553.80.1.el8_10, RHEL 8.8 SAP/TUS build 4.18.0-477.116.1.el8_8, or RHEL 8.6 build 4.18.0-372.166.1.el8_6 where relevant—and reboot systems to activate the mitigations.
See real exploitation activity before you spend the cycle.
16 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:21667, a Moderate-severity update for RHEL Server AUS 8.2 on x86_64, updating the kernel to 4.18.0-193.173.1.el8_2. It fixes 20 vulnerabilities, including CVE-2025-39751 and CVE-2022-50087, and requires affected systems to reboot after installation.
Red Hat issued Moderate-severity advisory RHSA-2025:21063 for RHEL 7 Extended Life Cycle Support, providing kernel version 3.10.0-1160.142.1.el7 for x86_64, s390x, ppc64, and ppc64le. The update fixes CVE-2025-39751 and five other kernel vulnerabilities, and requires a reboot after installation.
Red Hat issued RHSA-2025:19223 for RHEL 9.2 x86_64 SAP Solutions and Extended Life Cycle offerings using the Real Time Linux Kernel. The Moderate-severity update provides kernel-rt 5.14.0-284.144.1.rt14.429.el9_2 and fixes CVE-2025-39751 alongside three other Linux kernel vulnerabilities.
Red Hat published RHSA-2025:19222 for selected RHEL 8.6 support channels, supplying kernel version 4.18.0-372.166.1.el8_6. The update remediates CVE-2025-39751 and nine additional kernel CVEs.
Red Hat issued Moderate-severity advisory RHSA-2025:19104 for RHEL 9.4 EUS, AUS, SAP Update Services, Extended Life Cycle, and related channels. Kernel build 5.14.0-427.96.1.el9_4 fixes CVE-2025-39751 along with six other kernel CVEs and requires a reboot.
Red Hat issued RHSA-2025:18932 for RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The kernel update fixes CVE-2025-39751 alongside eight other Linux kernel CVEs.
Red Hat published RHSA-2025:18297, a Moderate-severity RHEL 8 kernel update that fixes CVE-2025-39751 in ALSA HDA CA0132 add_tuning_control. The update replaces the vulnerable behavior that permitted a buffer overflow and also fixes two other kernel vulnerabilities.
Red Hat published RHSA-2025:18281, a Moderate-severity RHEL 9 kernel update that fixes CVE-2025-39849 by capping SSID length in __cfg80211_connect_result(). The update also remediates six other kernel CVEs, including CVE-2022-50087.
Red Hat issued Moderate-severity advisory RHSA-2025:17570 for RHEL 8.8 Update Services for SAP Solutions and Telecommunications Update Service. The kernel 4.18.0-477.114.1.el8_8 update fixes eight vulnerabilities, including CVE-2022-50087 in ARM SCPI firmware, and requires a reboot.
Red Hat issued Moderate-severity advisory RHSA-2025:16919 for RHEL 8, delivering kernel version 4.18.0-553.77.1.el8_10. The update fixes CVE-2022-50087 in ARM SCPI probing, plus NFS server, HFSC traffic-scheduling, and SCTP vulnerabilities; affected systems require a reboot.
Red Hat received Bug 2396928 for CVE-2025-39849 through OSIDB Bzimport. The cfg80211 SME connection-result handling could corrupt memory when supplied an SSID longer than 32 bytes.
An upstream Linux CVE advisory for CVE-2022-50087 was referenced. The flaw could leave the exported scpi_info pointer referring to freed memory after a failed ARM SCPI driver probe.
An upstream CVE advisory was published for CVE-2025-22026, an NFS server flaw in which nfsd_proc_stat_init() ignored svc_proc_register() failures. The fix propagates the registration result and prevents nfsd_net construction when procfile registration fails.
Red Hat addressed CVE-2021-47609, a string-overflow vulnerability in the Linux kernel ARM SCPI generic power-domain driver, for Red Hat Enterprise Linux 8. The issue was resolved upstream and remediated through advisories RHSA-2024:7000 and RHSA-2024:7001.
Red Hat documented CVE-2025-37797, a Linux kernel HFSC queueing-discipline use-after-free caused by a time-of-check/time-of-use condition in hfsc_change_class(). The upstream fix adds a second queue-length check after qdisc_peek_len(), and Red Hat remediated the flaw across affected RHEL 7, 8, 9, and 10 streams.
Red Hat documented CVE-2022-49985, an eBPF vulnerability in which tnum_range() could overapproximate BPF poke-descriptor array indices and permit an out-of-range value, causing a KASAN slab-out-of-bounds read in bpf_int_jit_compile. The issue was addressed across multiple RHEL 8 and RHEL 9 update-service variants, including advisories RHSA-2025:15471, RHSA-2025:15472, RHSA-2025:18043, RHSA-2025:22752, RHSA-2026:5693, and RHSA-2026:5732.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
21 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released kernel security updates for RHEL 9.6 and RHEL 10.0 that address multiple vulnerabilities across NFSD, NFS, KVM on ARM64, ALSA UMP, Intel ASoC, libceph, and other kernel subsystems. RHSA-2026:0804 provides kernel `5.14.0-570.79.1.el9_6` for RHEL 9.6 support channels and is rated Important, while Moderate-rated RHSA-2026:1236 provides kernel `6.12.0-55.55.1.el10_0` for RHEL 10.0, including applicable EUS and CodeReady Linux Builder repositories across supported architectures. The updates remediate **CVE-2025-37891**, an ALSA Universal MIDI Packet conversion flaw in which a four-byte buffer could receive up to six bytes of malformed SysEx data, potentially causing memory corruption; the upstream correction expands the buffer to six bytes. Red Hat also previously updated RHEL 8 kernels through RHSA-2025:21917 to fix an NFS write-update race condition, **CVE-2025-39697**, and an i40e driver index-validation flaw, **CVE-2025-39971**. Administrators should deploy the applicable kernel packages and reboot affected systems for fixes to take effect.
Aug 25, 2026
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9.0 SAP Solutions, RHEL 9.2 SAP and associated offerings, and RHEL 10/10.2 variants. The advisories remediate vulnerabilities in networking, HID, SCTP, ALSA audio, RDMA, KVM, event polling, TLS, cryptographic, and Wi-Fi code, including buffer overflows, use-after-free conditions, and recursion that could exhaust kernel resources. Key fixes include `CVE-2025-38614` in eventpoll, `CVE-2025-39864` in cfg80211, `CVE-2025-39903` affecting NUMA memory-node handling, and `CVE-2025-39946` in TLS stream handling. Affected organizations should deploy the applicable kernel packages—`5.14.0-70.151.1.el9_0` for RHEL 9.0 SAP, `5.14.0-70.151.1.rt21.223.el9_0` for its real-time kernel, and `5.14.0-284.144.1.el9_2` for RHEL 9.2 SAP—across x86_64, aarch64, ppc64le, and s390x systems as applicable. Red Hat requires a reboot after installation for mitigations to take effect; its kernel maintenance also includes a resolved Intel SOF HDA issue, `CVE-2022-50050`, where unsafe handling of `snprintf()` output could lead to a buffer overflow.
Aug 26, 2026