Loading story…
Red Hat released Important-rated Linux kernel updates for RHEL 7 Extended Life Cycle Support, RHEL 8.2 Advanced Update Support, and RHEL 9.0 Update Services for SAP Solutions, including corresponding Real Time kernel packages. The advisories remediate multiple kernel memory-safety and scheduler defects, notably CVE-2025-38250, a use-after-free race in the Bluetooth Virtual HCI driver's vhci_flush() path, and CVE-2025-38177, an unsafe HFSC traffic-control queue notification flaw that could cause repeated state updates and unsafe RB-tree removal.
The updates also address double-free, use-after-free, information-disclosure, NFS, ext4, ftrace, AMD TEE, QRTR, and network-scheduler issues, plus CVE-2022-49991, in which hugetlb atomic-copy handling could corrupt page->mapping. Updated packages include kernel-3.10.0-1160.137.1.el7 for RHEL 7 ELS, kernel-4.18.0-193.165.1.el8_2 for RHEL 8.2 AUS, kernel-rt-3.10.0-1160.137.1.rt56.1289.el7 for RHEL 7 Real Time ELS, and kernel-rt-5.14.0-70.144.1.rt21.216.el9_0 for RHEL 9 SAP systems; administrators must reboot after installation for the fixes to take effect.
See real exploitation activity before you spend the cycle.
24 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2025:14749 for the kernel-rt package in RHEL 9.0 Update Services for SAP Solutions on x86_64. The fixed 5.14.0-70.144.1.rt21.216.el9_0 build addressed eight kernel issues, including CVE-2022-49991 hugetlb page-mapping corruption; systems must be rebooted after installation.
Red Hat issued Important-rated RHSA-2025:14748 for the standard Linux kernel in RHEL 7 Extended Life Cycle Support across x86_64, s390x, ppc64, and ppc64le. Kernel version 3.10.0-1160.137.1.el7 remediated nine vulnerabilities, including CVE-2025-38177 and CVE-2025-38350, and requires a reboot.
Red Hat issued Important-rated RHSA-2025:14746 for the RHEL 7 Extended Life Cycle Support Real Time kernel on x86_64. Kernel-rt version 3.10.0-1160.137.1.rt56.1289.el7 fixed nine flaws, including CVE-2025-38177 and CVE-2025-38350; affected systems require a reboot.
Red Hat issued Important-rated RHSA-2025:14742 for RHEL Server 8.2 Advanced Update Support on x86_64, providing kernel version 4.18.0-193.165.1.el8_2. The update fixed eight vulnerabilities, including CVE-2025-38250 in Bluetooth VHCI and several HFSC scheduler flaws; Red Hat required a reboot after installation.
Red Hat issued Moderate-rated RHSA-2025:14136 for RHEL Server 8.2 Advanced Update Support on x86_64, providing kernel version 4.18.0-193.164.1.el8_2. The update fixed six vulnerabilities, including CVE-2024-57980, CVE-2025-21928, CVE-2021-47670, CVE-2022-49788, CVE-2022-50020, and CVE-2025-38086; affected systems require a reboot.
Red Hat issued Important-rated RHSA-2025:13030 for RHEL 9.0 Update Services for SAP Solutions, providing kernel build 5.14.0-70.141.1.el9_0. The update fixed five vulnerabilities, including CIFS buffer overflow CVE-2022-49058, UVC dangling pointer CVE-2024-58002, Intel ISH HID use-after-free CVE-2025-21928, VMCI information leak CVE-2022-49788, and TIPC use-after-free CVE-2025-38052; systems require a reboot.
An upstream Linux CVE announcement disclosed CVE-2025-38177, affecting the sch_hfsc HFSC traffic-control queueing discipline. The flaw involved non-idempotent hfsc_qlen_notify() behavior and unsafe repeated queue-tree updates.
Red Hat issued Moderate-rated RHSA-2025:10179 for RHEL Server 8.2 Advanced Update Support on x86_64, providing kernel version 4.18.0-193.156.1.el8_2. The update remediated five vulnerabilities—CVE-2022-49395, CVE-2022-49111, CVE-2022-49114, CVE-2022-49122, and CVE-2022-49328—and requires a reboot after installation.
An upstream Linux CVE advisory disclosed CVE-2022-50020, an ext4 flaw in which an online resize to a size not aligned with the filesystem cluster boundary can cause negative growth, trigger a BUG_ON, and corrupt the in-memory superblock. The upstream fix prevents resizing to a partial cluster size.
An upstream Linux CVE announcement disclosed CVE-2025-38000, an HFSC sch_hfsc enqueue accounting flaw. A child qdisc peek operation could dequeue or drop a packet before HFSC updated queue length and backlog, potentially leaving an empty class active and leading to use-after-free; the fix updates accounting before peek().
Red Hat recorded CVE-2022-49122, a medium-severity Linux device-mapper ioctl flaw where a user-controlled cmd value could be speculatively used as an array index to expose kernel memory to userspace. The upstream fix uses array_index_nospec to constrain speculative array access.
An upstream Linux CVE advisory disclosed CVE-2022-49058, a CIFS symbolic-link handling flaw in which an unvalidated link_len value parsed with sscanf() could exceed the link_str destination buffer. The upstream fix adds a bounds check before the length is used.
Red Hat issued Important-rated RHSA-2023:0334 for RHEL 9 kernel packages, fixing CVE-2022-2959 and vulnerabilities including CVE-2022-2964, CVE-2022-3077, CVE-2022-30594, CVE-2022-4139, and CVE-2022-43945. The update applied across supported RHEL 9 architectures and related support offerings; affected systems require a reboot.
Red Hat issued Important-rated RHSA-2022:8974 for the RHEL 9.0 Extended Update Support Real Time kernel on x86_64, providing kernel-rt version 5.14.0-70.36.1.rt21.108.el9_0. The update remediated flaws including KVM CVE-2022-1158, Open vSwitch CVE-2022-2639, watch queue CVE-2022-2959, NFS CVE-2022-43945, and multiple AMD and Intel speculative-execution issues; systems require a reboot.
Red Hat addressed CVE-2022-49977, an ftrace failure-path flaw where a stale operation can remain in ftrace_ops_list after ftrace is disabled, allowing is_ftrace_trampoline to dereference it and crash the kernel. Fixes remove the operation from the list when ftrace_startup_enable fails and were distributed through multiple RHEL 8 and RHEL 9 advisories.
Red Hat addressed CVE-2025-38001, in which reentrant HFSC enqueue operations with NETEM and HFSC_RSC can insert a class into the eligible-time tree twice, causing an hfsc_dequeue loop and potentially a use-after-free. The fix verifies that an HFSC_RSC class is not already in the tree; advisories covered multiple RHEL 8 and RHEL 9 update-service variants.
Red Hat listed additional kernel fixes for the Bluetooth VHCI use-after-free CVE-2025-38250, including RHSA-2025:14985 for RHEL 8.8 Telecommunications Update Service. The expanded coverage also includes RHEL 8.4 mission-critical and extended-update channels through RHSA-2025:15035.
Red Hat remediated CVE-2022-50044 through RHSA-2025:14744 and RHSA-2025:14749 for RHEL 9.0 Update Services for SAP Solutions. The QRTR-over-MHI flaw could drop service-discovery events or trigger a kernel panic; the fix delays MHI transfer enablement until after QRTR endpoint creation.
Red Hat addressed CVE-2022-49991 for RHEL 9.0 Update Services for SAP Solutions in RHSA-2025:14744. The hugetlb_mcopy_atomic_pte flaw could corrupt page->mapping when page-cache pages were incorrectly treated as new anonymous mappings.
Red Hat addressed the HFSC scheduler flaw CVE-2025-38177 in multiple additional RHEL support variants, including advisories RHSA-2025:14413, 14511, 14691, 14692, 14696, 14744, 15016, and 15035. These advisories covered RHEL 7.7, multiple RHEL 8 support channels, and RHEL 9 SAP and Extended Update Support variants.
Red Hat addressed CVE-2025-38250, a use-after-free in Bluetooth VHCI vhci_flush(), through RHSA-2025:13960 and RHSA-2025:13961 for RHEL 8, RHSA-2025:13962 for RHEL 9, and RHSA-2025:14009 for RHEL 10. The fix adds SRCU synchronization between device reset and unregister operations.
Red Hat closed its tracking bug for CVE-2022-43945, an NFSD RPC-over-TCP malformed-message flaw that can cause a server buffer-overflow condition and denial of service without an out-of-bounds memory access. Red Hat documented fixes across RHEL 8, RHEL 9, and RHEL 9.0 EUS channels; Fedora fixed the issue in stable kernel 5.19.17.
Red Hat closed its tracking bug for CVE-2022-1158 after issuing fixes across several RHEL 8 and RHEL 9 specialized and extended-support channels. The KVM flaw allowed user-controlled guest-memory update values to write outside previously mapped guest-memory space.
Red Hat closed the tracking bug for CVE-2022-2959 after addressing the Linux watch-queue use-after-free through RHSA-2022:8973, RHSA-2022:8974, RHSA-2022:9082, RHSA-2023:0300, RHSA-2023:0334, and RHSA-2023:0348. The flaw stemmed from missing synchronization in pipe_resize_ring(), allowing a notification path to access a freed pipe buffer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
26 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026
Red Hat released kernel security updates across **RHEL 7 Extended Life Cycle Support**, RHEL 8 and its real-time variants, RHEL 9.2 SAP-related lifecycle channels, and RHEL 10. The advisories remediate multiple memory-safety and denial-of-service issues, including use-after-free flaws in the page-pool subsystem (`CVE-2025-38129`) and the teql queueing discipline (`CVE-2026-23074`). The page-pool race can result in a freed page pool being accessed during page recycling and may enable arbitrary code execution; the teql flaw may enable local privilege escalation. Other fixes address buffer overflows, NULL-pointer dereferences, slab out-of-bounds conditions, and flaws in Squashfs, BPF sockmap, SCTP, IPv6, and procfs code paths. Organizations should apply the relevant Red Hat kernel builds, including `4.18.0-553.107.1.el8_10` for affected RHEL 8 deployments and `5.14.0-284.161.1.el9_2` for applicable RHEL 9.2 SAP systems. Red Hat requires affected systems to be rebooted after installation for the updated kernel and mitigations to take effect; teams should prioritize systems where untrusted local users or workloads can access vulnerable kernel functionality.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026