Loading story…
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (CVE-2025-37810), SunRPC TLS-alert processing (CVE-2025-38566), VKMS/DRM use-after-free and double-free conditions (CVE-2025-22097), UDP memory-accounting leaks (CVE-2025-22058), RDMA/IWCM use-after-free (CVE-2025-38211), POSIX CPU-timer races (CVE-2025-38352), and a sch_qfq scheduler race (CVE-2025-38477). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references.
Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel 5.14.0-284.137.1.el9_2, RHEL 9.2 real-time kernel 5.14.0-284.140.1.rt14.425.el9_2, and RHEL 8.2 AUS kernel 4.18.0-193.168.1.el8_2. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-security advisory RHSA-2025:17123 for the RHEL 9.2 Real Time Linux Kernel in SAP Solutions and Extended Life Cycle offerings. Kernel-rt version 5.14.0-284.140.1.rt14.425.el9_2 remediates six vulnerabilities affecting USB DWC3, i40e, vsock, DRM/GEM, netfilter conntrack, and the SMB client; systems must be rebooted.
Red Hat issued Moderate-severity RHSA-2025:17009 for RHEL 8.8 update-service variants, delivering kernel-4.18.0-477.112.1.el8_8. It fixes CVE-2025-22097 in DRM/VKMS, CVE-2025-22058 in UDP accounting, and CVE-2025-38477 in the sch_qfq scheduler; a reboot is required.
Red Hat published Moderate-severity advisory RHSA-2025:16354 for RHEL 10 and applicable CodeReady Linux Builder repositories across x86_64, aarch64, s390x, and ppc64le. The update fixes CVE-2025-37810 in the USB DWC3 gadget driver and CVE-2025-38566 in SunRPC TLS-alert handling; affected systems must be rebooted.
Red Hat published Important-rated RHSA-2025:15669 for supported RHEL 9.2 update and lifecycle services. The 5.14.0-284.137.1.el9_2 kernel update fixes VKMS, UDP memory-accounting, RDMA/IWCM, and POSIX CPU-timer flaws and requires a reboot.
Red Hat issued Important-rated advisory RHSA-2025:15656 for RHEL Server 8.2 Advanced Update Support on x86_64. Kernel version 4.18.0-193.168.1.el8_2 fixes six issues, including flaws in ext4, IPv6 multicast, UDP accounting, MD RAID10, POSIX CPU timers, and TIPC; systems require a reboot after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released kernel security updates across **RHEL 7 Extended Life Cycle Support**, RHEL 8 and its real-time variants, RHEL 9.2 SAP-related lifecycle channels, and RHEL 10. The advisories remediate multiple memory-safety and denial-of-service issues, including use-after-free flaws in the page-pool subsystem (`CVE-2025-38129`) and the teql queueing discipline (`CVE-2026-23074`). The page-pool race can result in a freed page pool being accessed during page recycling and may enable arbitrary code execution; the teql flaw may enable local privilege escalation. Other fixes address buffer overflows, NULL-pointer dereferences, slab out-of-bounds conditions, and flaws in Squashfs, BPF sockmap, SCTP, IPv6, and procfs code paths. Organizations should apply the relevant Red Hat kernel builds, including `4.18.0-553.107.1.el8_10` for affected RHEL 8 deployments and `5.14.0-284.161.1.el9_2` for applicable RHEL 9.2 SAP systems. Red Hat requires affected systems to be rebooted after installation for the updated kernel and mitigations to take effect; teams should prioritize systems where untrusted local users or workloads can access vulnerable kernel functionality.
Aug 26, 2026
Red Hat released Linux kernel security updates across Red Hat Enterprise Linux (RHEL) 8, 9, and 10 channels, addressing vulnerabilities including **CVE-2025-37823**, a potential use-after-free in the HFSC network scheduler's `hfsc_dequeue()` path, and **CVE-2025-38498**, which allowed mount propagation-type changes to be attempted on unmounted mounts or mounts outside the caller's mount namespace. The mount fix restricts these operations to mounts within the caller's namespace. Related updates also remediate flaws in ETS/netem queue-disc handling, ARM SCPI, SMB/CIFS, USB, Intel network drivers, IPv6 multicast, XFRM, and SunRPC TLS-alert handling. Affected offerings include standard, SAP, real-time, AUS, TUS, Extended Update Support, and extended-lifecycle RHEL deployments. Notable packages include RHEL 9.2 kernel `5.14.0-284.142.1.el9_2`, RHEL 9.4 kernel `5.14.0-427.94.1.el9_4`, RHEL 8.6 kernel `4.18.0-372.164.1.el8_6`, and RHEL 9.0 SAP real-time kernel `5.14.0-70.149.1.rt21.221.el9_0`; RHEL 10 updates cover x86_64, aarch64, ppc64le, and s390x systems. Organizations should install the applicable advisory updates and reboot hosts to load the corrected kernel.
Aug 26, 2026