Loading story…
Red Hat issued kernel security updates for RHEL 7 Extended Lifecycle Support, RHEL 8, RHEL 9, and RHEL for Real Time 7, remediating vulnerabilities in USB, networking, storage, and scheduler components. The updates address CVE-2022-50229, a use-after-free in the ALSA BCD2000 driver's probe-error path; CVE-2023-53125, which could expose kernel memory through an oversized packet length in the SMSC75xx USB Ethernet driver; and CVE-2025-38392, an invalid locking-context flaw in the idpf network driver when MAC-filter capability is enabled.
The RHEL 7 advisories also cover issues in USB audio, RAID10, Intel i40e networking, and the QFQ scheduler, while the RHEL 9 update includes fixes for the DWC3 USB gadget driver, mount type changes, and the s390 SCLP subsystem. RHEL 8 customers should install kernel version 4.18.0-553.75.1.el8_10; RHEL for Real Time 7 customers should install 3.10.0-1160.140.1.rt56.1292.el7. Administrators should deploy the applicable updated kernel packages across supported architectures and reboot systems to activate the fixes.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-rated RHSA-2025:17161 for RHEL 7 Extended Lifecycle Support on x86_64, s390x, ppc64, and ppc64le. The update fixes CVE-2022-50229 and CVE-2023-53125 among six kernel vulnerabilities; administrators must reboot after applying the supplied kernel build.
Red Hat issued Moderate-rated RHSA-2025:17109 for RHEL for Real Time 7 Extended Life Cycle Support on x86_64. The kernel-rt update fixes CVE-2022-50229 and CVE-2023-53125, among four other kernel vulnerabilities, and requires a reboot.
Red Hat issued Moderate-rated RHSA-2025:16398 for RHEL 9 kernel packages. It remediates CVE-2023-53125 by limiting smsc75xx packet length to skb->len, as well as CVE-2025-37810, CVE-2025-38498, and CVE-2025-39694.
Red Hat issued Important-rated RHSA-2025:15785 for RHEL 8, supplying kernel version 4.18.0-553.75.1.el8_10. The update fixes CVE-2023-53125 and CVE-2025-38392, along with CVE-2025-38350 and CVE-2025-38449; affected systems require a reboot after installation.
An upstream Linux kernel CVE announcement for CVE-2023-53125 was referenced. The flaw in the smsc75xx USB-network driver could allow a packet-length value exceeding skb->len to expose kernel memory through a cloned socket buffer.
Red Hat issued Important-rated RHSA-2025:2473 for RHEL 8, providing kernel version 4.18.0-553.44.1.el8_10. The update fixes four kernel flaws affecting HID, ALSA USB-audio, megaraid_sas, and PPS components; affected systems require a reboot.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released Important-rated RHEL 9 kernel and real-time kernel updates that remediate a broad set of Linux kernel vulnerabilities across networking, traffic control, XFRM, IPv6, USB, Wi-Fi, memory management, and virtualization components. The updates include `kernel-rt-5.14.0-284.11.1.rt14.296.el9_2` for x86_64 and corresponding standard kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 9 deployments, including EUS, ELS, SAP, AUS, and CodeReady variants. Notable fixes include races and memory-safety flaws tracked as `CVE-2022-3028`, `CVE-2022-3567`, `CVE-2022-3522`, `CVE-2022-4129`, `CVE-2022-43750`, `CVE-2022-47929`, `CVE-2023-0394`, and `CVE-2023-0590`. Impacts range from local denial of service and kernel-information disclosure to potential privilege escalation; `CVE-2022-3628` can be triggered through a malicious USB device against the `brcmfmac` Wi-Fi driver. Organizations should apply the applicable supported RHEL kernel errata, reboot systems to activate the new kernel, and, where patching `CVE-2022-3628` is not immediately possible, prevent loading the `brcmfmac` module.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel updates for supported **RHEL 8** and **RHEL 9** channels, including SAP, telecommunications, EUS, AUS, ELC, and mission-critical offerings. The advisories address multiple flaws across NFS, network scheduling, USB, KVM, vsock, HID, Bluetooth, cryptography, storage, and firmware components; affected systems span x86_64, s390x, ppc64le, and aarch64 platforms depending on the advisory. Key fixes include **CVE-2025-39751**, a buffer overflow in the ALSA HDA CA0132 driver's `add_tuning_control()` function caused by unbounded `sprintf`; **CVE-2025-39849**, which could corrupt memory when cfg80211 processed a Wi-Fi connection-result SSID longer than 32 bytes; and **CVE-2022-50087**, an ARM SCPI driver use-after-free condition following a failed probe. Organizations should install the applicable updated kernel packages—including RHEL 8.10 build `4.18.0-553.80.1.el8_10`, RHEL 8.8 SAP/TUS build `4.18.0-477.116.1.el8_8`, or RHEL 8.6 build `4.18.0-372.166.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026