Loading story…
Red Hat released Important Linux kernel updates for Red Hat Enterprise Linux 9 to remediate multiple security flaws, including CVE-2025-38052, a use-after-free read in the TIPC networking subsystem. The flaw occurs when asynchronous encryption work accesses TIPC cryptographic state after it has been freed during network-namespace deletion; the upstream fix preserves a network-namespace reference until encryption processing finishes.
The RHSA-2025:12746 update also addresses other kernel use-after-free issues, an integer-overflow vulnerability in CIFS processing, and an information-disclosure flaw in VMware VMCI datagram handling. Affected RHEL 9 systems include x86_64, ARM64, IBM Z, and Power little-endian deployments across standard, EUS, ELS, SAP, AUS, and CodeReady Linux Builder offerings; Red Hat also issued fixes for CVE-2025-38052 in supported RHEL 8 and RHEL 10 variants. Organizations should apply the appropriate kernel updates and reboot systems for the fixes to take effect.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:16045, an Important security advisory providing kpatch live-patch packages for RHEL 8.6 Update Services for SAP Solutions and applicable Extended Life Cycle Long Life deployments. The update remediates CVE-2025-38052 and CVE-2025-38352 for x86_64 and ppc64le systems.
Red Hat issued RHSA-2025:15933, an Important security advisory providing kpatch live-patch modules for RHEL 9.0 Update Services for SAP Solutions. The update remediates CVE-2025-38052 and CVE-2025-38352 for x86_64 and ppc64le systems across several 5.14.0-70 kernel builds.
Red Hat issued RHSA-2025:16008, an Important security advisory providing kpatch live-patch packages for RHEL 8.8 Update Services for SAP Solutions. The update remediates CVE-2025-38052 and CVE-2025-38352 for x86_64 and ppc64le systems, including applicable Extended Life Cycle offerings.
Red Hat issued RHSA-2025:15931, an Important security advisory providing kpatch live-patch updates for RHEL 9.2 SAP Update Services, AUS, and Extended Life Cycle offerings. The update remediates CVE-2025-38052 and CVE-2025-38352 for x86_64 and ppc64le systems.
Red Hat issued RHSA-2025:15932, an Important security advisory providing kpatch live-patch modules for RHEL 9.4 kernel builds. The update remediates CVE-2025-38052 and CVE-2025-38352 for x86_64 and ppc64le RHEL 9.4 EUS, AUS, SAP Update Services, and Extended Life Cycle offerings.
Red Hat issued RHSA-2025:15798, an Important RHEL 9 security advisory providing updated kpatch live-patch modules for CVE-2025-38052 and the POSIX CPU-timer race CVE-2025-38352. The update covers x86_64 and ppc64le RHEL 9 offerings, including EUS, ELS, AUS, and SAP variants.
Red Hat issued RHSA-2025:12746, an Important RHEL 9 kernel security update addressing multiple flaws, including CVE-2025-38052 and several use-after-free vulnerabilities. The update applies to supported RHEL 9 architectures and offerings, and Red Hat required systems to reboot after installation for the fixes to take effect.
Syzbot reported CVE-2025-38052, a slab use-after-free read in the Linux kernel TIPC asynchronous encryption-completion handler tipc_aead_encrypt_done. The upstream fix retains a network-namespace reference so TIPC crypto state cannot be freed before deferred encryption work completes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released multiple Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8 and 9, addressing use-after-free, double-free, buffer-overflow, integer-overflow, out-of-bounds, and information-disclosure vulnerabilities. The updates cover standard, Real Time, NFV, SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder offerings across x86_64, aarch64, s390x, and ppc64le systems. Among the corrected issues is **CVE-2025-21999**, a race condition in `proc_get_inode()` that could cause a use-after-free during concurrent `/proc` inode creation and kernel-module removal. The flaw relies on `delete_module`, requiring `CAP_SYS_MODULE`, but Red Hat included the fix in RHEL 9 kernel updates alongside flaws in Bluetooth L2CAP, CIFS/SMB, cfg80211, md, bnxt, UVC, ext4, VMCI, ATM, and other kernel components. Administrators should install the applicable errata and reboot affected systems to load the patched kernel.
Aug 26, 2026
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026