Loading story…
Red Hat released kernel updates addressing CVE-2025-38211, a use-after-free vulnerability in the Linux kernel's RDMA iWARP Connection Manager (RDMA/iwcm). The flaw can occur when an event-handler work item drops the final reference to a cm_id while the workqueue can still access the associated work object; it was reproducible through the blktests nvme/061 test using RDMA transport and the siw driver.
The fix moves final cm_id reference handling into the connection-manager destruction context, preventing work objects from being freed prematurely. Red Hat included the fix in the Moderate-severity RHEL 8 advisory RHSA-2025:15008, providing kernel 4.18.0-553.72.1.el8_10 for x86_64, aarch64, ppc64le, and s390x systems, including selected Extended Life Cycle deployments; administrators should install the updated packages and reboot. Red Hat also issued related kernel security updates across RHEL product streams, including RHEL 10 packages that remediate multiple kernel flaws.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity RHSA-2025:17192 for RHEL 9.0 Update Services for SAP Solutions on x86_64, updating kernel-rt to version 5.14.0-70.148.1.rt21.220.el9_0. The update fixes CVE-2025-38211 along with CVE-2022-49969, CVE-2022-50211, CVE-2025-38461, and CVE-2025-38449; Red Hat requires a reboot after installation.
Red Hat issued Moderate-severity RHSA-2025:16669 for RHEL 9.4, providing kernel version 5.14.0-427.91.1.el9_4. The update remediates CVE-2025-38211 and four other kernel vulnerabilities across supported RHEL 9.4 channels and architectures; affected systems require a reboot after installation.
Red Hat issued Important-rated RHSA-2025:15669 for RHEL 9.2 Update and Lifecycle Services, providing kernel version 5.14.0-284.137.1.el9_2. The update remediates CVE-2025-38211 along with CVE-2025-22097, CVE-2025-22058, and CVE-2025-38352 across supported architectures and requires a reboot.
Red Hat issued RHSA-2025:15011, an Important advisory providing updated RHEL 9 kernel packages that remediate CVE-2025-38211 and several additional kernel vulnerabilities. The update affects RHEL 9 across x86_64, ARM64, s390x, and ppc64le, and requires a reboot after installation.
Red Hat issued Moderate-severity RHSA-2025:15009 for RHEL 8 Real Time Linux, Real Time for NFV, and x86_64 RHEL 8.10 Extended Life Cycle. Kernel-rt version 4.18.0-553.72.1.rt7.413.el8_10 fixes CVE-2025-38211 and CVE-2025-38464; systems require a reboot after installation.
Red Hat issued RHSA-2025:15008 for RHEL 8 and RHSA-2025:15005 for RHEL 10, providing kernel updates that remediate CVE-2025-38211, an RDMA/iwcm use-after-free involving work objects after cm_id destruction. The updates cover the listed supported architectures and require a reboot to take effect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2025:13598** for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across `x86_64`, `aarch64`, `ppc64le`, and `s390x` systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues. Among the fixed issues, **CVE-2025-38079** affects the AF_ALG `algif_hash` socket `hash_accept` path: a local low-privileged attacker may trigger a double free and slab use-after-free through `accept(2)` under a specific `MSG_MORE` and `crypto_ahash_import` failure condition, potentially causing memory corruption or code execution. **CVE-2025-38084** fixes a hugetlb page-table race during virtual-memory-area splitting, while **CVE-2025-38159** corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the `rtw88` module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026