Loading story…
Red Hat released Moderate-severity kernel updates for Red Hat Enterprise Linux 9 and 10 to remediate CVE-2024-36357, a transient-execution flaw in certain AMD processors. A local attacker with low privileges could potentially infer data held in the L1D cache, exposing sensitive information across privilege boundaries; Red Hat rates the issue CVSS 5.6.
For RHEL 9, fixes are provided through RHSA-2025:19930 and RHSA-2025:20518; RHEL 10 is addressed by RHSA-2025:20095. RHSA-2025:19930 also fixes CVE-2024-36350 and adds a conditional IBPB mitigation for CVE-2025-40300 (VMSCAPE). Administrators should install the applicable kernel updates and reboot systems for the protections to take effect; RHEL 6, 7, and 8 kernel packages are out of support scope and should be considered affected under Red Hat policy.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:20518 for the RHEL 9 kernel and RHSA-2025:20095 for the RHEL 10 kernel, addressing CVE-2024-36357.
Red Hat published RHSA-2025:19930, a Moderate-severity RHEL 9 kernel update that fixes CVE-2024-36357 alongside CVE-2024-36350 and adds a conditional IBPB mitigation for CVE-2025-40300. Systems must be rebooted after installation for the updated kernel to take effect.
Red Hat released RHBA-2025:15878, fixing CVE-2024-36357 in the Red Hat Enterprise Linux 9 linux-firmware package.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel and `linux-firmware` updates across supported RHEL 7, 8, and 9 streams to address two AMD processor side-channel flaws: **CVE-2023-20593** (Zenbleed) and **CVE-2023-20569** (Inception/RAS Poisoning). Zenbleed affects AMD Zen 2 processors and may expose data left in YMM registers by another process or thread; Inception can let a local attacker manipulate return-address prediction and induce speculative execution that discloses information. Both issues require local, low-privilege access and primarily affect confidentiality. The remediation includes AMD microcode delivered through updated `linux-firmware` packages and, for applicable RHEL streams, kernel updates. Red Hat issued `linux-firmware-20200421-81.git78c0348.el7_9` for RHEL 7 and `linux-firmware-20180911-69.2.git85c5d90.el7_6` for RHEL Server AUS 7.6; RHEL 9.0 EUS kernel `5.14.0-70.80.1.el9_0` also includes fixes for the AMD flaws alongside other kernel vulnerabilities. Administrators should apply the relevant supported-channel updates and reboot systems after kernel installation so protections take effect.
Aug 26, 2026
Red Hat released kernel updates for **RHEL 9** and **RHEL 10** addressing several locally exploitable Linux kernel flaws, including `CVE-2025-21647` in the `sch_cake` traffic-control scheduler. An underflow in per-host bulk-flow fairness counters could lead to an out-of-bounds read, potentially exposing kernel memory or crashing the system; Red Hat assigned it a CVSS 3.1 score of 7.1. The upstream correction adds centralized bounds checking for counter access. The updates also remediate denial-of-service issues in the mt76 `mt7925` Wi-Fi driver (`CVE-2024-57989`), HID core (`CVE-2024-57986`), IDPF driver (`CVE-2024-58057`), and Realtek Bluetooth setup path (`CVE-2024-57987`). These flaws can trigger NULL-pointer dereferences, CPU-workqueue starvation, or system crashes under local attack conditions. RHEL 9 `kernel-rt` remains affected or will not fix for several listed issues; organizations should apply the applicable kernel errata and reboot systems to activate the patched kernel.
Aug 26, 2026
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026