Loading story…
Red Hat released Important kernel security updates for RHEL 9, including the real-time kernel for RHEL 9.2 SAP Solutions and Extended Life Cycle environments, addressing CVE-2025-38332. The flaw affects BIOS-version handling in the Linux SCSI lpfc Fibre Channel driver: FORTIFY-enabled strlcat() can incorrectly flag a destination-buffer overflow and cause a kernel panic despite receiving the correct buffer size.
The upstream remediation replaces the affected zero-initialization and strlcat() logic with memcpy() while retaining NUL termination required by lpfc_printf_log(). RHSA-2025:14005 provides kernel-rt-5.14.0-284.131.1.rt14.416.el9_2 for affected x86_64 RHEL 9.2 SAP and ELC systems; RHSA-2025:15661 delivers fixes across supported RHEL 9 architectures and also addresses three additional kernel flaws. Organizations should install the applicable updated kernel packages and reboot systems to activate the fixes.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat released Important-rated advisory RHSA-2025:15661 for RHEL 9 kernel packages across supported architectures and applicable support variants. The update remediates CVE-2025-38332 in the lpfc driver along with three other kernel flaws, and requires a reboot after installation.
Red Hat issued Important-rated RHSA-2025:15646 for the kernel-rt package on RHEL for Real Time 7 x86_64 under Extended Lifecycle Support. The update provides kernel-rt-3.10.0-1160.139.1.rt56.1291.el7, fixes CVE-2025-38332 and CVE-2025-38352, and requires affected systems to reboot.
Red Hat issued Important-rated RHSA-2025:15648 for RHEL 7 Extended Life Cycle Support. Kernel version 3.10.0-1160.139.1.el7 fixes CVE-2025-38332 and the POSIX CPU timer race CVE-2025-38352 for x86_64, s390x, ppc64, and ppc64le systems; a reboot is required.
Red Hat issued Important-rated RHSA-2025:15649 for RHEL 8.8 Update Services for SAP Solutions and Extended Life Cycle Long Life systems. The kernel update, version 4.18.0-477.110.1.el8_8 for x86_64 and ppc64le, fixes CVE-2025-38332 alongside three other vulnerabilities and requires a reboot.
Red Hat issued Important-rated RHSA-2025:14003 for RHEL 9.2 kernel packages across AUS, SAP Update Services, four-year update services, and Extended Life Cycle offerings. The update fixes CVE-2025-38332 and four other kernel vulnerabilities, supplies kernel release 5.14.0-284.131.1.el9_2 for x86_64, aarch64, ppc64le, and s390x, and requires a reboot.
Red Hat published an Important-rated security update for RHEL 9.2 Update Services for SAP Solutions and Extended Life Cycle x86_64 systems. RHSA-2025:14005 fixes CVE-2025-38332 and four other kernel vulnerabilities; affected systems must reboot after updating.
An upstream Linux CVE announcement identified CVE-2025-38332 in the SCSI lpfc driver's BIOS-version handling. The remediation replaces memset() and strlcat() usage with memcpy() while preserving NUL termination to prevent a FORTIFY-triggered kernel panic.
An upstream Linux CVE announcement disclosed CVE-2025-38159, an out-of-bounds read in the rtw88 Wi-Fi driver's `para` buffer handling. The fix expands the buffer from two to six bytes so the five-byte read beginning at `para[1]` is safe.
CVE-2025-38352 was documented as a Linux kernel race between handle_posix_cpu_timers() and posix_cpu_timer_del() during task exit and reaping. The upstream fix adds an exit_state check in run_posix_cpu_timers(); the referenced material also states that CISA added the flaw to its Known Exploited Vulnerabilities catalog after confirmed in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026