Loading story…
Red Hat issued Important kernel security updates for RHEL 9 and RHEL 10 that remediate CVE-2025-38089, a flaw in Linux SunRPC server authentication handling. A crafted RPC request can produce an SVC_GARBAGE result without initializing an acceptance-status pointer, potentially crashing a kernel thread on its first RPC request or causing memory corruption. The upstream correction maps the condition to AUTH_ERROR with AUTH_BADCRED, in line with RFC 5531.
RHSA-2025:11411 delivers the SunRPC fix for RHEL 9 across x86_64, ARM64, s390x, and ppc64le channels, alongside a uvcvideo dangling-pointer fix for CVE-2024-58002. RHSA-2025:11428 updates RHEL 10 kernels and addresses five vulnerabilities affecting uvcvideo, iwlwifi, huge_memory, and SunRPC components. Red Hat also fixed CVE-2022-49995, a writeback use-after-free that can occur after disk-device removal, in RHEL 9 SAP Update Services packages. Organizations should install the applicable kernel updates and reboot systems to activate the fixes.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat published the Important RHSA-2025:11428 kernel security advisory for RHEL 10. It remediates CVE-2024-58002, CVE-2024-57980, CVE-2025-21905, CVE-2025-37958, and CVE-2025-38089; a reboot is required for the updated kernel to take effect.
Red Hat published the Important RHSA-2025:11411 kernel security advisory for RHEL 9. The update fixes CVE-2024-58002 in uvcvideo and CVE-2025-38089 in SunRPC authentication processing; systems require a reboot after installation.
Red Hat released live kpatch-patch fixes for CVE-2025-38089 in RHSA-2025:12976 for applicable RHEL 9 streams and RHSA-2025:12977 for RHEL 9.4 Extended Update Support. These updates address the SunRPC authentication-processing flaw without requiring the standard kernel-update reboot path.
Red Hat addressed the Linux kernel writeback use-after-free vulnerability CVE-2022-49995 for RHEL 9.0 Update Services for SAP Solutions through RHSA-2025:12525 and RHSA-2025:12526.
The Linux kernel CVE team assigned CVE-2025-38089 for a remotely triggerable SunRPC server authentication-processing flaw that can cause a NULL-pointer kernel crash or memory scribble via a crafted RPC packet. Upstream fixes treat SVC_GARBAGE during authentication as an AUTH_ERROR and are available in Linux 6.6.95, 6.12.35, 6.15.4, and 6.16-rc3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for Red Hat Enterprise Linux (RHEL) 8.8 SAP and Telecommunications Update Services, RHEL 9 and 9.4 support channels, and RHEL 10 offerings. The advisories address memory-corruption, use-after-free, out-of-bounds read/write, integer-overflow, information-disclosure, and denial-of-service vulnerabilities that could cause service disruption or, in some cases, privilege escalation. Affected packages span x86_64, s390x, ppc64le, and aarch64 systems, including SAP, Extended Update Support, Extended Life Cycle, and CodeReady Linux Builder channels. Notable fixes include MPTCP use-after-free flaw `CVE-2025-40133`, corrected in RHEL 10 through RHSA-2026:2282, and `CVE-2025-68811`, an `svcrdma` copy-offset defect that could cause `memcpy` operations outside the current page and was fixed across supported RHEL 9 and 10 releases. Other patched issues include `CVE-2025-68349`, `CVE-2026-22998`, and `CVE-2026-23074`; RHEL 8.8 customers should deploy kernel version `4.18.0-477.130.1.el8_8`. Red Hat requires systems to be rebooted after installation for the kernel fixes to take effect.
Aug 26, 2026
Red Hat released Important kernel security updates for **Red Hat Enterprise Linux (RHEL) 9**, RHEL 9 Real Time for SAP Solutions, and **RHEL 10**, addressing vulnerabilities in IPv6 multicast processing, ATM networking, OverlayFS, UDF, vmxnet3 XDP handling, AMD microcode interactions, and other kernel components. The affected issues include use-after-free, out-of-bounds read and write, and packet-processing flaws; RHEL 10 fixes include `CVE-2025-21759`, `CVE-2025-21991`, and `CVE-2025-37799`. The RHEL 9 updates also remediate `CVE-2022-49395`, an out-of-bounds stack read in User-Mode Linux LDT initialization caused by a byte-count versus long-count mismatch, and `CVE-2022-49846`, a slab out-of-bounds write in UDF directory-entry processing. Updates apply across supported x86_64, ARM64, IBM Z, and Power architectures and relevant EUS, ELS, SAP, and CodeReady variants. Organizations should deploy the applicable updated kernel packages and **reboot affected systems** to activate the fixes.
Aug 26, 2026