Loading story…
Red Hat released RHSA-2025:13598 for Red Hat Enterprise Linux 10, updating kernel packages to remediate seven Moderate-severity vulnerabilities across x86_64, aarch64, ppc64le, and s390x systems, including applicable Extended Update Support and lifecycle channels. The flaws include a double-free condition, memory-management races, out-of-bounds reads, invalid memory access, and hardware-related kernel issues.
Among the fixed issues, CVE-2025-38079 affects the AF_ALG algif_hash socket hash_accept path: a local low-privileged attacker may trigger a double free and slab use-after-free through accept(2) under a specific MSG_MORE and crypto_ahash_import failure condition, potentially causing memory corruption or code execution. CVE-2025-38084 fixes a hugetlb page-table race during virtual-memory-area splitting, while CVE-2025-38159 corrects an rtw88 Wi-Fi-driver out-of-bounds read that could disclose memory or crash the kernel; preventing the rtw88 module from loading is a temporary mitigation. Organizations should install the updated kernel and reboot affected RHEL 10 hosts.
See real exploitation activity before you spend the cycle.
15 events from the most recent confirmed update back to the earliest known activity.
Red Hat updated its RHEL 10 kernel security advisory RHSA-2025:13598.
Red Hat released RHSA-2025:13589 and RHSA-2025:13590, fixing the rtw88 out-of-bounds read in RHEL 8 kernel and kernel-rt packages.
Red Hat issued the Moderate-severity RHSA-2025:13598 kernel update for RHEL 10 across x86_64, aarch64, s390x, and ppc64le. It remediated seven kernel flaws, including CVE-2025-38079, CVE-2025-38084, and CVE-2025-38159, and required a reboot after installation.
Red Hat released RHSA-2025:12752 and RHSA-2025:12753 to fix CVE-2025-38079 in RHEL 8 kernel and kernel-rt packages.
Red Hat published CVE-2025-38159, an out-of-bounds read in the Linux kernel rtw88 Wi-Fi driver's Bluetooth/Wi-Fi coexistence handling. The upstream correction expands the para buffer from two to six bytes.
Red Hat published its record for CVE-2025-38079, a double-free flaw in the Linux kernel AF_ALG hash socket hash_accept path. The flaw can occur when crypto_ahash_import fails after accept(2) is called with MSG_MORE set, leading to a slab use-after-free condition.
Red Hat issued CVE-2025-38079 fixes for additional RHEL 8 and 9 SAP, telecommunications, extended-support, and update-service channels, including RHSA-2025:14511, 14691, 14696, 15016, 15658, and 15670. The source does not provide release dates for these advisories.
Red Hat addressed the hugetlb VMA-splitting page-table race condition tracked as CVE-2025-38084 for RHEL 9 through RHSA-2025:13962. The source does not state the release date of that advisory.
Red Hat released RHSA-2025:21667 to fix CVE-2025-38159 in the RHEL 8.2 Advanced Update Support kernel.
Red Hat released RHSA-2025:15660 to address CVE-2025-38159 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
Red Hat released RHSA-2025:15647 for RHEL 8.6 support channels and RHSA-2025:15649 for the RHEL 8.8 SAP Update Services channel, addressing CVE-2025-38159.
RHSA-2025:15035 fixed CVE-2025-38159 in the RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernel packages.
Red Hat released RHSA-2025:14986 and RHSA-2025:14987 for RHEL 7 Extended Lifecycle Support, and RHSA-2025:15035 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On.
Red Hat released RHSA-2025:14692 for RHEL 8.6 Advanced Mission Critical Update Support and Telecommunications Update Service, and RHSA-2025:14742 for RHEL 8.2 Advanced Update Support, addressing CVE-2025-38159.
Red Hat released fixes for CVE-2025-38079 through RHSA-2025:14742 for RHEL 8.2 Advanced Update Support and RHSA-2025:14692 for RHEL 8.6 Advanced Mission Critical Update Support, SAP Solutions, and Telecommunications Update Service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2026:21557**, an Important security update for the Linux kernel in **Red Hat Enterprise Linux 10** and related channels, addressing **18 vulnerabilities** across subsystems including CAN J1939, IMA, memory management, netfilter, conntrack, `io_uring`, Bluetooth, HID, Wi-Fi, XFS, and `dpaa2-switch`. The advisory applies to multiple RHEL 10 variants on `x86_64`, `ARM64`, IBM z Systems, and Power little endian, including Extended Update Support and Extended Life Cycle offerings, and Red Hat said affected systems must be **rebooted** after patching for the fixes to take effect. Among the flaws covered were **CVE-2026-31684**, a network scheduler bug triggered by specially crafted packets with nested VLAN headers that can cause an out-of-bounds read and system crash, and **CVE-2026-43027**, a netfilter `nf_conntrack_helper` cleanup flaw that can lead to a use-after-free condition, enabling denial of service and potentially privilege escalation. Red Hat rated both issues **moderate severity** with CVSS v3 scores of **7.1**, and said fixes were issued across multiple RHEL kernel package streams, including RHEL 7, 8, and 10 for the VLAN-related flaw and additional errata for the conntrack issue.
Aug 25, 2026
Red Hat released kernel updates for **RHEL 9** and **RHEL 10** addressing several locally exploitable Linux kernel flaws, including `CVE-2025-21647` in the `sch_cake` traffic-control scheduler. An underflow in per-host bulk-flow fairness counters could lead to an out-of-bounds read, potentially exposing kernel memory or crashing the system; Red Hat assigned it a CVSS 3.1 score of 7.1. The upstream correction adds centralized bounds checking for counter access. The updates also remediate denial-of-service issues in the mt76 `mt7925` Wi-Fi driver (`CVE-2024-57989`), HID core (`CVE-2024-57986`), IDPF driver (`CVE-2024-58057`), and Realtek Bluetooth setup path (`CVE-2024-57987`). These flaws can trigger NULL-pointer dereferences, CPU-workqueue starvation, or system crashes under local attack conditions. RHEL 9 `kernel-rt` remains affected or will not fix for several listed issues; organizations should apply the applicable kernel errata and reboot systems to activate the patched kernel.
Aug 26, 2026
Red Hat released **Important** Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8, 9, and 10, remediating vulnerabilities that could cause memory corruption, information disclosure, denial of service, and potentially privilege escalation. The advisories are `RHSA-2026:1142` for RHEL 8, `RHSA-2026:1143` for RHEL 9, and `RHSA-2026:1690` for RHEL 10, covering supported x86_64, ARM64/aarch64, IBM Z/s390x, and Power little-endian deployments, as well as applicable EUS, ELS, SAP, and CodeReady Linux Builder channels. Notable fixes include `CVE-2025-38453`, a use-after-free condition in `io_uring` `msg_ring` request handling; `CVE-2025-40301`, which could expose uninitialized memory or cause denial of service through Bluetooth HCI command-complete event processing; and `CVE-2025-38731`, a double-free flaw in the DRM Xe driver's `xe_vm_bind_ioctl` path. RHEL 8 updates also address Bluetooth, vsock memory-corruption, Intel ASoC, and VMware SVGA driver flaws. Organizations should deploy the appropriate updated kernel packages and reboot affected systems, as the fixes do not take effect until restart.
Aug 25, 2026