Loading story…
Red Hat released Moderate-severity advisory RHSA-2025:14438 for Red Hat Enterprise Linux 8 kernel packages, remediating CVE-2025-38200 and CVE-2025-22058. CVE-2025-38200 affects the Linux kernel's Intel i40e network driver: crafted device input can trigger an integer underflow in i40e_clear_hw, causing an MMIO write to an invalid page. Red Hat rates the flaw at CVSS 7.0, while NVD assigns 5.5.
Updated kernels are available for RHEL 8 on x86_64, s390x, ppc64le, and aarch64, including applicable Extended Life Cycle 8.10 and CodeReady Linux Builder repositories. The same advisory also fixes a UDP memory-accounting leak tracked as CVE-2025-22058. Organizations should apply the relevant kernel updates and reboot affected systems, as the fixes do not take effect until restart.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2025:14439 for RHEL 8 kernel-rt packages, remediating CVE-2025-22058. The update provides kernel-rt version 4.18.0-553.71.1.rt7.412.el8_10 for Real Time 8, Real Time for NFV 8, and x86_64 Extended Life Cycle 8.10; a reboot is required.
Red Hat published Moderate-severity advisory RHSA-2025:14438, providing RHEL 8 kernel version 4.18.0-553.71.1.el8_10 and fixing CVE-2025-38200 as well as CVE-2025-22058. The update applies to multiple architectures and requires a reboot to take effect.
Red Hat remediated CVE-2025-38200 for the Red Hat Enterprise Linux 10 kernel through advisory RHSA-2025:14510.
CVE-2025-38200, an integer-underflow vulnerability in the Linux kernel i40e driver's i40e_clear_hw function, was publicly disclosed. A device can trigger an MMIO write to an invalid page through specially crafted input.
Red Hat published the CVE-2025-22058 record for an integer-overflow flaw in Linux kernel UDP socket receive-memory accounting. A local low-privileged application can set SO_RCVBUF to INT_MAX and potentially trigger memory-accounting errors during socket closure.
Red Hat issued RHSA-2025:22752 to fix CVE-2025-38200 for RHEL 8.4 Advanced Mission Critical Update Support and the RHEL 8.4 Extended Update Support Long-Life Add-On.
Red Hat remediated CVE-2025-38200 for the RHEL 8.2 Advanced Update Support stream through RHSA-2025:21667.
Red Hat released an additional RHEL 10 kernel remediation for CVE-2025-38200 through RHSA-2025:20095.
Red Hat issued RHSA-2025:17161 to fix the RHEL 7 Extended Lifecycle Support kernel package. It also issued RHSA-2025:17124 for RHEL 8.6 Advanced Mission Critical Update Support and Telecommunications Update Service streams.
Red Hat fixed CVE-2025-38200 in the Red Hat Enterprise Linux 7 Extended Lifecycle Support kernel-rt package through RHSA-2025:17109.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, RHEL 9, and supported extended-life, update-service, SAP, and Real Time variants. The advisories address **Native Branch History Injection** (`CVE-2024-2201`), a Spectre-v2-related speculative-execution flaw on recent Intel CPUs that can bypass FineIBT mitigations and leak kernel memory, alongside vulnerabilities in networking, storage, filesystems, device drivers, wireless code, and CPU handling. Included fixes cover an AF_UNIX garbage-collector race (`CVE-2024-26923`), improper LLSEC key-resource release in `mac802154` (`CVE-2024-26961`), an MPTCP uninitialized-state issue (`CVE-2024-40931`), USB CDC-WDM log-flooding that can trigger CPU soft lockups (`CVE-2024-40904`), and an out-of-bounds `tty` imageblit access (`CVE-2021-47383`). Organizations should install the applicable updated kernel packages—including RHEL 8.6 builds `4.18.0-372.113.1.el8_6`, `4.18.0-372.121.1.el8_6`, or `4.18.0-372.124.1.el8_6` where relevant—and reboot systems to activate the mitigations.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026