Loading story…
Red Hat released Moderate-severity kernel updates for Red Hat Enterprise Linux 8, including Real Time, Real Time for NFV, and selected Extended Life Cycle deployments, to remediate three Linux wireless-subsystem vulnerabilities. The fixes address CVE-2023-53226, an out-of-bounds access and integer-underflow flaw in the mwifiex Wi-Fi driver's received-packet handling; CVE-2023-53257, involving mac80211 S1G action-frame size handling; and CVE-2025-39864, a use-after-free vulnerability in cfg80211's cmp_bss() function.
The standard RHEL 8 update is provided as kernel version 4.18.0-553.82.1.el8_10 for x86_64, s390x, ppc64le, and aarch64 systems, while the Real Time update is kernel-rt-4.18.0-553.82.1.rt7.423.el8_10. Organizations running affected RHEL 8 variants should install the applicable RHSA updates and reboot systems to load the corrected kernel.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2025:22998 for RHEL 8.8 Extended Life Cycle Long Life, Telecommunications Update Service, and SAP Solutions offerings. The update provides kernel build 4.18.0-477.122.1.el8_8, remediating CVE-2023-53226 alongside CVE-2025-39697 and CVE-2022-50406; affected systems require a reboot.
Red Hat issued Moderate-severity advisory RHSA-2025:19447 for RHEL 8 kernel packages, remediating CVE-2023-53226 alongside CVE-2023-53257 and CVE-2025-39864. The update supplied kernel version 4.18.0-553.82.1.el8_10 and required affected systems to be rebooted.
Red Hat issued Moderate-severity advisory RHSA-2025:19440 for RHEL 8 kernel-rt packages, fixing CVE-2023-53226 along with CVE-2023-53257 and CVE-2025-39864. The updated kernel-rt release was 4.18.0-553.82.1.rt7.423.el8_10.
An upstream Linux CVE announcement referenced CVE-2023-53226, covering out-of-bounds access and integer-underflow flaws in received-packet processing by the mwifiex Wi-Fi driver.
Red Hat addressed the iomap writeback memory-corruption flaw CVE-2022-50406 through advisories RHSA-2025:21051, 21084, 21091, 21128, 21136, 23445, 23463, and 23960 for affected RHEL 7, 8, and 9 extended-support, SAP, telecommunications, and mission-critical offerings. RHSA-2025:22998 was also listed but is already captured in the timeline.
Red Hat published RHSA-2024:5101 and RHSA-2024:5102 for RHEL 8, remediating the low-severity ath11k Wi-Fi driver locking flaw CVE-2023-52777. The issue concerns GTK offload status-event locking and was fixed upstream as “wifi: ath11k: fix gtk offload status event locking.”
The Linux kernel CVE team announced CVE-2023-52530, a potential key use-after-free vulnerability in the mac80211 Wi-Fi subsystem. The issue was resolved upstream by the fix titled "wifi: mac80211: fix potential key use-after-free."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
7 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Moderate-severity RHEL 8 kernel updates `4.18.0-348.el8` and real-time kernel updates `4.18.0-348.rt7.130.el8` to remediate numerous Linux kernel vulnerabilities across eBPF, networking, Bluetooth, filesystems, device drivers, memory handling, and wireless components. The advisories affect standard RHEL 8 deployments across x86_64, ARM64, IBM Z, and Power little-endian, as well as RHEL for Real Time, Real Time for NFV, related telecommunications editions, and specified x86_64 Extended Life Cycle offerings. Among the fixed issues is `CVE-2020-36158`, a buffer overflow in the Marvell `mwifiex` Wi-Fi driver’s `mwifiex_cmd_802_11_ad_hoc_start` function. A sufficiently privileged local attacker could trigger the flaw with an overly long SSID while creating an ad-hoc wireless network, potentially achieving arbitrary code execution; affected upstream kernels extend through version 5.10.4. Organizations should apply RHSA-2021:4356 or RHSA-2021:4140 as applicable and reboot systems to activate the patched kernel; blacklisting the `mwifiex` module is a mitigation where immediate patching is not possible.
Aug 28, 2026
Red Hat released `kernel-rt-4.18.0-553.64.1.rt7.405.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10. The moderate-severity update remediates **CVE-2025-21905**, an out-of-bounds read in the Linux `iwlwifi` driver caused by logging firmware strings that may not be NUL-terminated; the condition could disclose memory contents or crash an affected system. The advisory, **RHSA-2025:11851**, also fixes **CVE-2025-21919**, which can cause scheduler-related memory corruption, and **CVE-2022-49977**, an `ftrace` NULL-pointer dereference. Red Hat rated CVE-2025-21905 at CVSS 6.0 because exploitation in its products is local and requires high privileges, while NVD and CVE.org scored it 7.1. Administrators should apply the updated real-time kernel and reboot systems for the protections to take effect.
Aug 26, 2026
Red Hat released moderate-severity Linux kernel security updates for RHEL 10 and RHEL 8 Real Time deployments, addressing flaws in ublk, NFS server handling, memory-failure processing, Intel `e1000e` and `i40e` drivers, and the `mt76` Wi-Fi driver. The affected RHEL 10 offerings include standard, Extended Update Support, extended-life-cycle, four-year-support, and CodeReady Linux Builder repositories across x86_64, ARM64, IBM Z/s390x, and Power little-endian platforms. The updates remediate `CVE-2025-39918`, a linked-list corruption issue in the `mt76` driver caused by scheduled WCID entries remaining on a temporary stack list; Red Hat also issued fixes for RHEL 9 and RHEL 9.6 EUS. RHEL 8 kernel-rt packages fix `CVE-2025-39697`, an NFS race condition during updates to an existing write, and `CVE-2025-39971`, insufficient index validation in an `i40e` configuration-queues message. Organizations should install the applicable updated kernel or kernel-rt packages and reboot affected systems to activate the fixes.
Aug 26, 2026