Loading story…
Red Hat remediated CVE-2024-53241, a moderate-severity Linux kernel flaw in the x86 Xen paravirtualized iret hypercall path. The Xen hypercall page could be unsafe under speculative execution, potentially allowing a low-privileged attacker to disclose sensitive information; Red Hat scored the issue 5.7 CVSS v3.1, while NVD scored it 5.5. The fix encodes the required iret sequence directly in xen-asm.S rather than jumping through the Xen hypercall page.
RHEL 8 received fixes in April 2025, including kernel-rt build 4.18.0-553.50.1.rt7.391.el8_10 through RHSA-2025:3894; affected systems require a reboot. A related RHEL 8 kernel build, 4.18.0-553.50.1.el8_10, caused early-boot invalid-opcode panics in some Xen HVM guests on XenServer, IBM Cloud Classic, and legacy-BIOS AWS t2.xlarge instances, but 4.18.0-553.51.1.el8_10 resolved the boot issue. Red Hat later released fixes for RHEL 9 and RHEL 10 kernels, while RHEL 9 kernel-rt and OpenShift Container Platform 4 RHCOS were designated will-not-fix.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20518 for the RHEL 9 kernel and RHSA-2025:20095 for the RHEL 10 kernel to address CVE-2024-53241.
Red Hat released RHSA-2025:3893 for the RHEL 8 kernel and RHSA-2025:3894 for RHEL 8 kernel-rt, addressing CVE-2024-53241. RHSA-2025:3894 supplied kernel-rt version 4.18.0-553.50.1.rt7.391.el8_10 and required a reboot for the update to take effect.
Red Hat publicly listed CVE-2024-53241, a Linux kernel Xen paravirtualized iret-hypercall vulnerability associated with Xen Security Advisory XSA-466.
RHEL 8 kernel 4.18.0-553.51.1.el8_10 was reported to restore booting on affected Xen HVM guests after version 4.18.0-553.50.1.el8_10 caused invalid-opcode panics in xen_time_init.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat disclosed **CVE-2026-64561**, a moderate-severity flaw in the Linux kernel's KVM subsystem caused by improper validation of MMU page roots after those pages are made available. The bug can cause KVM to map memory into an invalid root, allowing child shadow pages to inherit an invalid state and potentially leading to **system instability or denial of service** in virtualized environments. Red Hat scored the issue at **CVSS 7.0**, while `cve.org` lists **8.8**, and classified it as **`CWE-825` Expired Pointer Dereference**; Red Hat said multiple Red Hat Enterprise Linux kernel packages were fixed through July 2026 errata, while **RHEL 6** was not affected because the vulnerable code is absent. In a separate kernel advisory, **RHSA-2026:49030**, Red Hat released updated **RHEL 10.0** kernel packages to fix two additional **KVM-related vulnerabilities**, **`CVE-2025-40026`** and **`CVE-2026-63807`**, across standard, Extended Update Support, and 4-year update channels. The advisory lists fixed packages as **`kernel-6.12.0-55.94.1.el10_0`** for `x86_64`, `s390x`, `ppc64le`, and `aarch64`, including associated CodeReady Linux Builder repositories, and noted that affected systems must be **rebooted** after installation for the protections to take effect.
Aug 25, 2026
Red Hat released a series of **Important** security updates for Red Hat Enterprise Linux and OpenShift Container Platform to address Linux kernel vulnerabilities including `CVE-2025-40026` in **KVM on x86** and `CVE-2026-52923` in the **SysV IPC checkpoint/restore path**. The KVM flaw affects nested virtualization: after KVM has allowed an L2 guest I/O operation, changes to L1 or host userspace I/O interception during the userspace exit can cause KVM to wrongly re-check intercepts, leave `vcpu->arch.pio.count` non-zero, trigger a `WARN`, and disrupt guest execution. The IPC flaw stems from `ipc_idr_alloc()` passing `ids->next_id` to `idr_alloc()` without enforcing the valid `ipc_mni` range, allowing out-of-range allocation, stale IDR entries, and a potential use-after-free during `/proc/sysvipc/shm` traversal. Affected fixes were published across multiple product streams, including **RHEL 8.4**, **RHEL 8.8**, **RHEL 9.4**, **RHEL 9.6**, and **OpenShift Container Platform 4.18.53**, alongside other kernel CVEs such as `CVE-2025-10263`, `CVE-2026-31787`, and `CVE-2026-53059`. Red Hat rated both headline issues as **Moderate**, but noted that `CVE-2026-52923` has been associated with a reported local privilege-escalation exploit targeting **RHEL 10**, while `CVE-2025-40026` can be mitigated by disabling nested virtualization for `kvm_intel` and `kvm_amd`. Red Hat said updated kernel packages and release images are available for multiple architectures and advised customers to **reboot systems after applying kernel updates** and upgrade OpenShift clusters through the supported release channels.
Aug 25, 2026