Loading story…
Red Hat released RHSA-2026:1495 for the RHEL 9.0 Update Services for SAP Solutions kernel-rt stream, updating the Real Time Linux Kernel to 5.14.0-70.163.1.rt21.235.el9_0. The Important-rated update remediates 13 kernel vulnerabilities across networking, virtualization, storage, RDMA, audio, vsock, MPTCP, and graphics components, including CVE-2025-37803; systems must be rebooted after installation.
CVE-2025-37803 affects the Linux udmabuf driver’s udmabuf_create() function, where 32-bit page-limit arithmetic could overflow when deriving a limit from size_limit_mb. A local user with access to the udmabuf device could request unexpectedly large DMA-buffer allocations, potentially causing memory pressure or allocation failures; Red Hat rates the issue Moderate and does not assess it as network reachable or a direct memory-corruption condition. The upstream correction casts the value to u64, and fixes are available in stable kernels beginning with 5.4.293, 5.10.237, 5.15.181, 6.1.136, 6.6.89, and 6.14.5; upstream recommends updating to a current stable kernel rather than cherry-picking the patch.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated RHSA-2026:1495 for the RHEL 9.0 Update Services for SAP Solutions x86_64 Real Time Linux Kernel. The kernel-rt update to version 5.14.0-70.163.1.rt21.235.el9_0 remediates 13 kernel vulnerabilities and requires a reboot after installation.
Red Hat released RHSA-2025:11571 for the RHEL 9.2 Update Services for SAP Solutions kernel and RHSA-2025:11572 for its kernel-rt stream, addressing CVE-2025-37803.
The Linux kernel CVE team disclosed CVE-2025-37803, a buffer-size integer overflow in the udmabuf driver's page-limit calculation during udmabuf creation. Fixed stable releases included 5.4.293, 5.10.237, 5.15.181, 6.1.136, 6.6.89, 6.14.5, and 6.15-rc2; users were advised to update rather than cherry-pick the fix.
Red Hat released RHSA-2025:15429 for RHEL 9 and RHSA-2025:15447 for RHEL 10, remediating the udmabuf integer-overflow vulnerability CVE-2025-37803.
Red Hat released RHSA-2025:11810, addressing CVE-2025-37803 in the Red Hat Enterprise Linux 9.4 Extended Update Support kernel stream.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Important-rated kernel and `kernel-rt` updates for affected Red Hat Enterprise Linux (RHEL) 8 and 9 deployments, remediating vulnerabilities including **CVE-2023-0386**, a FUSE flaw that allows a low-privileged local user to escalate privileges, and **CVE-2023-0179**, a Netfilter/nftables integer overflow that can disclose memory addresses and potentially enable root-level code execution. The advisories also address use-after-free defects in Bluetooth L2CAP (**CVE-2022-3564**), ALSA PCM handling (**CVE-2023-0266**), and NFSv4.2 server-side copy handling (**CVE-2022-4379**), the latter of which can permit remote denial of service, as well as procfs stack-overflow and TC mirred CPU soft-lockup flaws. The updates span standard kernels, Real Time kernels, and support-channel variants including EUS, AUS, TUS, SAP, NFV, and telecommunications offerings across x86_64, aarch64, s390x, ppc64le, and selected IBM Power systems. Administrators should deploy the applicable updated kernel packages and reboot systems to activate conventional kernel fixes; RHEL 8 customers covered by RHSA-2023:1659 can instead install the updated `kpatch-patch` module, which loads automatically to live-patch four vulnerabilities without a normal reboot.
Aug 26, 2026
Red Hat released Important security updates for Real Time Linux Kernel packages in Red Hat Enterprise Linux (RHEL) 8.4 and RHEL 9.0 support channels. The updates address multiple kernel memory-safety and logic flaws, including use-after-free vulnerability **CVE-2022-3545** in the Netronome NFP driver, NULL-pointer dereference **CVE-2023-2166** in the CAN protocol implementation, and an out-of-bounds read/possible privilege-escalation issue, **CVE-2023-2176**, in the RDMA Connection Manager. They also remediate **CVE-2022-38096**, a vmwgfx driver NULL-pointer dereference that a local user with access to DRM device nodes could use to crash a host. Affected deployments include RHEL 9.0 Extended Update Support for SAP Solutions using `kernel-rt-5.14.0-70.85.1.rt21.156.el9_0`, and RHEL 8.4 Real Time variants using `kernel-rt-4.18.0-305.125.1.rt7.201.el8_4`, including long-life, telecommunications, and NFV support offerings. The advisories collectively fix additional use-after-free, reference-counting, memory-boundary, networking, netfilter, and local privilege-escalation defects; organizations should apply the applicable kernel-rt update and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026