Loading story…
Red Hat released Moderate-severity kernel updates for RHEL 9.2 SAP Solutions, associated Extended Update Support and Extended Life Cycle channels, addressing CVE-2023-52933 in Linux SquashFS. A corrupted filesystem image can supply an xattr_ids count of 4294967071, which is interpreted as -225 in a signed variable; resulting integer-overflow behavior can calculate a zero-length xattr index table and allow a corrupted xattr_table_start value to bypass a sanity check. The upstream fix uses unsigned handling for xattr_ids and safe u64 widening in metadata-size calculations, including on 32-bit systems.
RHSA-2025:11045 provides kernel version 5.14.0-284.125.1.el9_2, while RHSA-2025:10527 provides Real Time Kernel version 5.14.0-284.125.1.rt14.410.el9_2. Both advisories also remediate CVE-2022-49395, an out-of-bounds read in User-Mode Linux LDT setup. Administrators should install the applicable kernel packages and reboot affected systems to activate the fixes.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2025:11045 for RHEL 9.2 update-service and extended-life-cycle channels. Updated kernel-5.14.0-284.125.1.el9_2 packages remediate CVE-2023-52933 across supported architectures, with a reboot required for the fix to take effect.
Red Hat issued Moderate-severity advisory RHSA-2025:10527 for RHEL 9.2 SAP Solutions Update Services and Extended Life Cycle x86_64 subscriptions. The kernel-rt update, version 5.14.0-284.125.1.rt14.410.el9_2, fixes CVE-2023-52933 and requires a reboot after installation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released kernel updates for multiple Linux vulnerabilities affecting Red Hat Enterprise Linux (RHEL) 8 and 9 product streams. The issues include `CVE-2024-26982`, a SquashFS invalid-inode handling flaw that can let a low-privileged local attacker trigger an out-of-bounds read and denial of service; `CVE-2024-36939`, improper NFS error handling during `nfs_net_init()`; and `CVE-2024-40978`, a qedi SCSI-driver bug that can crash the kernel when a debugfs attribute is read because a user-space pointer is passed to `sprintf()`. Red Hat also addressed `CVE-2023-52840`, a use-after-free in the Synaptics RMI4 input driver’s `rmi_unregister_function()` path. The bug can free the function object through `put_device()` before later dereferencing it, with availability impact possible. Organizations should deploy the applicable updated RHEL kernel packages, including relevant extended-update-support releases; RHEL 9 `kernel-rt` remained affected for the Synaptics issue at the time of the advisory, while no standalone mitigation was identified for the SquashFS flaw.
Aug 26, 2026
Red Hat released Moderate-severity kernel updates for RHEL 9.2 servicing streams, including Extended Update Support, Update Services for SAP Solutions, and Extended Life Cycle offerings, to remediate **CVE-2024-25744** and **CVE-2023-52628**. CVE-2024-25744 allows an untrusted virtual-machine monitor to trigger `int80` system-call handling at arbitrary points in affected Linux kernels, impacting Intel TDX confidential-computing and AMD memory-encryption-related code; upstream fixed it in Linux 6.6.7. CVE-2023-52628 is a four-byte out-of-bounds stack write in netfilter/nftables extended-header processing, with potential remote reachability requiring environment-specific validation. RHSA-2024:2845 supplies kernel version `5.14.0-284.66.1.el9_2` for supported RHEL 9.2 architectures, while RHSA-2024:2846 provides the real-time kernel `5.14.0-284.66.1.rt14.351.el9_2` for affected x86_64 deployments; administrators must reboot after installing the updates.
Aug 27, 2026
Red Hat released kernel security updates across **RHEL 7 Extended Life Cycle Support**, RHEL 8 and its real-time variants, RHEL 9.2 SAP-related lifecycle channels, and RHEL 10. The advisories remediate multiple memory-safety and denial-of-service issues, including use-after-free flaws in the page-pool subsystem (`CVE-2025-38129`) and the teql queueing discipline (`CVE-2026-23074`). The page-pool race can result in a freed page pool being accessed during page recycling and may enable arbitrary code execution; the teql flaw may enable local privilege escalation. Other fixes address buffer overflows, NULL-pointer dereferences, slab out-of-bounds conditions, and flaws in Squashfs, BPF sockmap, SCTP, IPv6, and procfs code paths. Organizations should apply the relevant Red Hat kernel builds, including `4.18.0-553.107.1.el8_10` for affected RHEL 8 deployments and `5.14.0-284.161.1.el9_2` for applicable RHEL 9.2 SAP systems. Red Hat requires affected systems to be rebooted after installation for the updated kernel and mitigations to take effect; teams should prioritize systems where untrusted local users or workloads can access vulnerable kernel functionality.
Aug 28, 2026