Loading story…
Red Hat released Important kpatch/live-patch updates for supported Red Hat Enterprise Linux 8 and 9 systems, including SAP, EUS, AUS, ELC, telecommunications, and mission-critical variants. The advisories remediate five Linux kernel vulnerabilities in the HFSC network scheduler and DesignWare I2C driver, including the HFSC use-after-free issue tracked as CVE-2025-37890, reentrant enqueue behavior, queue-length-accounting and empty-child-notification defects, and CVE-2025-38380.
CVE-2025-38380 stems from incomplete initialization in the AMD-specific amd_i2c_dw_xfer_quirk() routine: msg_write_idx was not initialized before i2c_dw_xfer_init() ran, potentially causing an out-of-bounds access to I2C message data. Updates cover RHEL 8 kernel 4.18.0-553.16.1.el8_10 and RHEL 9 kernel 5.14.0-570.17.1.el9_6, plus specified RHEL 9 SAP kernel builds, on x86_64 and ppc64le. Organizations should deploy the applicable kpatch packages and reboot affected hosts for the fixes to take effect.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2025:16580 for RHEL 8.6 kpatch packages serving Update Services for SAP Solutions and Extended Life Cycle Long Life systems. The update remediates CVE-2025-38380 and four HFSC scheduler flaws, including CVE-2025-37890, and requires a reboot to take effect.
Red Hat issued Important advisories RHSA-2025:16538, RHSA-2025:16541, RHSA-2025:16582, and RHSA-2025:16583, providing kpatch live-kernel updates for supported RHEL 8 and RHEL 9 offerings, including SAP-related subscriptions. The updates remediate CVE-2025-38380 alongside four HFSC network-scheduler vulnerabilities, and Red Hat stated that affected systems must be rebooted for the updates to take effect.
An upstream Linux CVE announcement disclosed CVE-2025-38380, an initialization flaw in the DesignWare I2C driver. The AMD-specific transfer quirk left msg_write_idx uninitialized, potentially enabling an out-of-bounds access to msgs; the upstream fix initializes the field before i2c_dw_xfer_init().
An upstream Linux CVE announcement disclosed CVE-2025-37890, a use-after-free vulnerability in the HFSC scheduler when a class uses a netem child queuing discipline. Netem packet duplication could cause reentrant duplicate insertion into HFSC timing trees; the upstream fix uses the n_active variable to prevent the duplicate insertion.
Red Hat issued Important advisory RHSA-2024:0386, providing kpatch-patch live-kernel updates for RHEL 9.0 Extended Update Support and associated SAP offerings on x86_64 and ppc64le. The update remediates HFSC use-after-free CVE-2023-4623, NVMe TCP crypto cleanup use-after-free CVE-2023-5178, and Intel IGB buffer-size flaw CVE-2023-45871.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2023:7417**, an Important security advisory supplying updated `kpatch-patch` live-kernel modules for Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions on x86_64 and IBM Power LE (`ppc64le`). The packages cover kernel streams `4.18.0-193.109.1`, `4.18.0-193.113.1`, and `4.18.0-193.116.1`, enabling affected systems to receive the fixes without a kernel reboot. The update remediates four Linux-kernel vulnerabilities: `CVE-2023-1829`, `CVE-2023-3609`, `CVE-2023-3776`, and `CVE-2023-4004`. `CVE-2023-1829` is a use-after-free and potential double-free issue in the traffic-control `tcindex` filter that may let a local attacker obtain root privileges; `CVE-2023-4004` is an Important-severity use-after-free in Netfilter nftables `nft_pipapo_remove()` that a low-privileged local user could trigger to crash a system or escalate privileges. Red Hat rated `CVE-2023-4004` CVSS 7.8 and noted that blocking the affected Netfilter module from loading can mitigate exposure where patching is not immediately possible.
Aug 26, 2026
Red Hat released **Important** kernel security updates and live patches for multiple Red Hat Enterprise Linux versions to remediate several Linux kernel vulnerabilities, including `CVE-2026-43499`, `CVE-2026-46116`, and `CVE-2026-46227`. The updates span standard kernel packages for **RHEL 7 ELS** and **RHEL 9**, as well as **kpatch** live-patch modules for **RHEL 9** and **RHEL 10**, allowing some systems to receive fixes without a reboot. The advisories also bundle additional kernel issues such as `CVE-2026-45984`, `CVE-2026-53166`, `CVE-2026-64531`, and `CVE-2026-31684`, affecting a broad set of x86_64, ppc64le, s390x, and aarch64 product variants, including SAP, EUS, and ELS offerings. The patched flaws include an **rtmutex** bug in `remove_waiter()` that could manipulate the wrong task state during futex proxy locking, an **xfrm** state-deletion bug that triggered slab use-after-free and out-of-bounds writes under repeated list removal, and an **SCTP** `SCTP_SENDALL` iterator flaw that could leave a stale association pointer after the socket lock was dropped, creating use-after-free or type-confusion conditions. Red Hat said fixes were propagated across numerous RHEL 8, 9, and 10 streams and support channels, with standard kernel packages requiring a reboot and `kpatch` updates available for selected RHEL 9 and RHEL 10 kernels.
Aug 25, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026