Loading story…
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9.0 SAP Solutions, RHEL 9.2 SAP and associated offerings, and RHEL 10/10.2 variants. The advisories remediate vulnerabilities in networking, HID, SCTP, ALSA audio, RDMA, KVM, event polling, TLS, cryptographic, and Wi-Fi code, including buffer overflows, use-after-free conditions, and recursion that could exhaust kernel resources. Key fixes include CVE-2025-38614 in eventpoll, CVE-2025-39864 in cfg80211, CVE-2025-39903 affecting NUMA memory-node handling, and CVE-2025-39946 in TLS stream handling.
Affected organizations should deploy the applicable kernel packages—5.14.0-70.151.1.el9_0 for RHEL 9.0 SAP, 5.14.0-70.151.1.rt21.223.el9_0 for its real-time kernel, and 5.14.0-284.144.1.el9_2 for RHEL 9.2 SAP—across x86_64, aarch64, ppc64le, and s390x systems as applicable. Red Hat requires a reboot after installation for mitigations to take effect; its kernel maintenance also includes a resolved Intel SOF HDA issue, CVE-2022-50050, where unsafe handling of snprintf() output could lead to a buffer overflow.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Moderate-severity RHSA-2025:21463 for RHEL 10 kernel packages across x86_64, s390x, ppc64le, and aarch64. The update fixes eventpoll recursion, cfg80211 use-after-free, NUMA memory-node kernel panic, and TLS bogus-header handling vulnerabilities; systems must be rebooted after installation.
Red Hat issued Moderate-severity RHSA-2025:19492 for the RHEL 9.0 Update Services for SAP Solutions kernel across x86_64, ppc64le, aarch64, and s390x. Kernel version 5.14.0-70.151.1.el9_0 fixes ten CVEs, including CVE-2022-50050, and requires a reboot after installation.
Red Hat issued Moderate-severity RHSA-2025:19268 for the RHEL 9.0 SAP Solutions x86_64 kernel-rt packages. Version 5.14.0-70.151.1.rt21.223.el9_0 remediates ten kernel CVEs, including CVE-2022-50050 in the Intel HDA component; a reboot is required for the update to take effect.
Red Hat issued Moderate-severity advisory RHSA-2025:19224 for RHEL 9.2 Update Services for SAP Solutions and associated offerings. Kernel version 5.14.0-284.144.1.el9_2 fixes four vulnerabilities affecting HID, SCTP, TLS, and ALSA CA0132 components.
Red Hat issued Moderate-severity advisory RHSA-2025:17776 for RHEL 10 kernel packages across x86_64, ARM64, IBM Z, and Power architectures. The update fixes CVE-2025-38556 in HID core, CVE-2025-39761 in the ath12k Wi-Fi driver, and CVE-2025-39757 in ALSA USB-audio; affected systems require a reboot after installation.
Red Hat issued Important-rated RHSA-2025:14696 for RHEL 9.2 Update Services for SAP Solutions and related support channels. Kernel version 5.14.0-284.134.1.el9_2 fixes five vulnerabilities in BPF, crypto algif_hash, ftrace, and network scheduling components; affected systems require a reboot.
Red Hat issued Moderate-severity RHSA-2025:13781 for RHEL 9.2 Update Services for SAP Solutions. Kernel version 5.14.0-284.130.1.el9_2 remediates nine vulnerabilities, including flaws in uvcvideo, padata, intel-ish-hid, AMD microcode handling, SELinux, and network drivers; a reboot is required.
An upstream advisory was published for CVE-2022-50050, a potential buffer overflow in the Linux kernel ASoC SOF Intel HDA component caused by use of snprintf() truncation return values. The upstream fix replaced snprintf() with scnprintf().
Red Hat addressed the Linux kernel HID-core zero-bit conversion vulnerability CVE-2025-38556 through RHSA-2025:16372 for RHEL 8 and RHSA-2025:17760 for RHEL 9, with additional affected RHEL support-channel variants also covered. The flaw could trigger a shift-out-of-bounds crash when HID report fields have a size of zero.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important kernel and real-time kernel updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, delivering `kernel` version `5.14.0-70.105.1.el9_0` for x86_64, ppc64le, aarch64, and s390x, and `kernel-rt` version `5.14.0-70.105.1.rt21.177.el9_0` for x86_64. The updates remediate **CVE-2024-0193**, a Netfilter use-after-free vulnerability in which local unprivileged users could potentially escalate privileges by triggering double deactivation during pipapo-set removal and catchall-element garbage collection. The advisories also address **CVE-2023-52434**, an SMB client out-of-bounds flaw caused by inadequate validation of SMB2 create-context offsets and lengths; Red Hat rates it 5.9 CVSS and considers adjacent-network denial of service the most likely impact. The standard kernel update additionally fixes a KVM use-after-free issue and a Netfilter protocol-number sanitization weakness, while the real-time update includes the latter Netfilter flaw. Administrators should apply the applicable packages and reboot affected systems for the fixes to take effect; preventing the `cifs` module from loading can mitigate the SMB issue until patching is complete.
Aug 26, 2026