Loading story…
Red Hat issued Important kernel security updates for CVE-2025-37914, a Linux traffic-control flaw in the net_sched Enhanced Transmission Selection (ETS) queuing discipline. When ETS uses a netem child qdisc, a reentrant enqueue callback can add the same classifier to ETS's active list twice, potentially causing memory corruption. The upstream correction prevents duplicate insertion by confirming both that the queue length is zero and that the class is not already active.
The fix was delivered through RHEL 8, 9, and 10 advisories, including RHEL 10 advisory RHSA-2025:14510, which also addresses CVE-2025-38200 in the i40e driver and CVE-2025-38417 in the ice driver across supported architectures. Red Hat also released updated Real Time Linux Kernel packages for RHEL 9.2 SAP Solutions and Extended Life Cycle systems under RHSA-2025:17735; affected organizations should install kernel-rt-5.14.0-284.142.1.rt14.427.el9_2 where applicable and reboot after updating.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:17735 for RHEL 9.2 Update Services for SAP Solutions and RHEL 9.2 Extended Life Cycle on x86_64. The kernel-rt update, version 5.14.0-284.142.1.rt14.427.el9_2, fixes CVE-2025-37914 and requires a reboot.
Red Hat published RHSA-2025:14510, an Important kernel security update for RHEL 10, remediating CVE-2025-37914 along with CVE-2025-38200 and CVE-2025-38417. Updated systems must be rebooted for the fixes to take effect.
The upstream Linux CVE announcement for CVE-2025-37914 was published. The flaw affects the net_sched ETS queuing discipline, where reentrant enqueue processing with a netem child qdisc can add a classifier to the active list twice and cause memory corruption.
Gerrard Tai reported that netem packet duplication can re-enter a classful parent qdisc before netem's queue length is updated, allowing the same child qdisc to be activated twice. An HFSC proof of concept deletes one class and triggers a use-after-free when HFSC subsequently dequeues from it; no patch was proposed.
Red Hat stated that reentrant ETS enqueue processing with a netem child qdisc can insert the same class twice into the active list, corrupting list structures; it said this specific condition does not involve a use-after-free. Red Hat assessed denial of service as the most practical impact, noted that exploitation requires local low-privileged access and a crafted qdisc hierarchy, and recommended preventing sch_ets from loading where ETS is unnecessary.
Red Hat identified advisories addressing CVE-2025-37914 for RHEL 8, RHEL 9, RHEL 9.4 Extended Update Support, and multiple RHEL 8.x and 9.x SAP, telecommunications, mission-critical, and extended-support variants, including RHSA-2025:13960, RHSA-2025:13961, RHSA-2025:14420, RHSA-2025:15668, RHSA-2025:17570, RHSA-2025:17734, RHSA-2025:18043, RHSA-2025:18054, RHSA-2025:18098, and RHSA-2025:22752.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated Linux kernel updates for RHEL 7 Extended Life Cycle Support, RHEL 8.2 Advanced Update Support, and RHEL 9.0 Update Services for SAP Solutions, including corresponding Real Time kernel packages. The advisories remediate multiple kernel memory-safety and scheduler defects, notably **CVE-2025-38250**, a use-after-free race in the Bluetooth Virtual HCI driver's `vhci_flush()` path, and **CVE-2025-38177**, an unsafe HFSC traffic-control queue notification flaw that could cause repeated state updates and unsafe RB-tree removal. The updates also address double-free, use-after-free, information-disclosure, NFS, ext4, ftrace, AMD TEE, QRTR, and network-scheduler issues, plus **CVE-2022-49991**, in which hugetlb atomic-copy handling could corrupt `page->mapping`. Updated packages include `kernel-3.10.0-1160.137.1.el7` for RHEL 7 ELS, `kernel-4.18.0-193.165.1.el8_2` for RHEL 8.2 AUS, `kernel-rt-3.10.0-1160.137.1.rt56.1289.el7` for RHEL 7 Real Time ELS, and `kernel-rt-5.14.0-70.144.1.rt21.216.el9_0` for RHEL 9 SAP systems; administrators must reboot after installation for the fixes to take effect.
Aug 26, 2026
Red Hat released Important-rated kernel and kernel-rt updates for Red Hat Enterprise Linux 7 Extended Lifecycle Support, addressing memory-safety flaws in the Intel `i40e` and `e1000e` network drivers and a vsock vulnerability. The `i40e_vc_config_queues_msg()` flaw, tracked as **CVE-2025-39971**, inadequately validates traffic-class indexes and can enable a low-privileged attacker to trigger out-of-bounds memory access, potentially causing memory corruption, denial of service, or code execution; Red Hat rates it CVSS 7.6. The updates also remediate **CVE-2025-39898**, a heap-overflow condition in `e1000_set_eeprom()` caused by insufficient EEPROM-change length validation, and **CVE-2025-40248**, which can cause vsock memory corruption. RHSA-2026:1581 covers RHEL 7 ELS systems on x86_64, IBM Z, and IBM Power, while RHSA-2026:1623 supplies kernel-rt version `3.10.0-1160.146.1.rt56.1298.el7` for RHEL for Real Time 7 x86_64 ELS. Red Hat says no qualifying mitigations are available and requires a reboot after installation for the fixes to take effect.
Aug 25, 2026
Red Hat released kernel updates for **RHEL 9** and **RHEL 10** addressing several locally exploitable Linux kernel flaws, including `CVE-2025-21647` in the `sch_cake` traffic-control scheduler. An underflow in per-host bulk-flow fairness counters could lead to an out-of-bounds read, potentially exposing kernel memory or crashing the system; Red Hat assigned it a CVSS 3.1 score of 7.1. The upstream correction adds centralized bounds checking for counter access. The updates also remediate denial-of-service issues in the mt76 `mt7925` Wi-Fi driver (`CVE-2024-57989`), HID core (`CVE-2024-57986`), IDPF driver (`CVE-2024-58057`), and Realtek Bluetooth setup path (`CVE-2024-57987`). These flaws can trigger NULL-pointer dereferences, CPU-workqueue starvation, or system crashes under local attack conditions. RHEL 9 `kernel-rt` remains affected or will not fix for several listed issues; organizations should apply the applicable kernel errata and reboot systems to activate the patched kernel.
Aug 26, 2026