Loading story…
Red Hat released Moderate-severity RHEL 9.0 Extended Update Support kernel updates addressing CVE-2021-33631, an integer-overflow flaw in ext4's ext4_write_inline_data_end(), and CVE-2023-6931, an out-of-bounds write in perf_read_group() caused by perf_event read_size overflow. CVE-2021-33631 also affected openEuler kernel versions 4.19.90 before 4.19.90-2401.3 and 5.10.0-60.18.0 before 5.10.0-183.0.0; the underlying issue was fixed upstream in Linux 6.2.
RHSA-2024:1836 provides kernel 5.14.0-70.97.1.el9_0 for RHEL 9.0 EUS and SAP Update Services on x86_64, s390x, ppc64le, and aarch64. RHSA-2024:1840 supplies the Real Time kernel 5.14.0-70.97.1.rt21.169.el9_0 for x86_64 SAP Solutions 9.0 Update Services. Organizations using the affected EUS or real-time kernel packages should deploy the applicable update and reboot systems to activate the fixes.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2024:1840 for the RHEL 9.0 Extended Update Support Real Time Linux Kernel. The kernel-rt-5.14.0-70.97.1.rt21.169.el9_0 update fixes CVE-2021-33631 and CVE-2023-6931.
Red Hat issued RHSA-2024:1836 for RHEL 9.0 Extended Update Support and associated offerings, providing kernel 5.14.0-70.97.1.el9_0. The update remediates CVE-2021-33631 and CVE-2023-6931 across x86_64, s390x, ppc64le, and aarch64 packages.
The upstream Linux kernel fixed the ext4_write_inline_data_end() integer-overflow issue associated with CVE-2021-33631 in Linux kernel version 6.2, via commit 5c099c4fdc438014d5893629e70a8ba934433ee8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel and Real Time kernel updates for Red Hat Enterprise Linux 9.0 Extended Update Support, remediating six Linux kernel vulnerabilities. The flaws include multiple use-after-free conditions, an out-of-bounds access in XFS, a kernel-pointer information disclosure issue in nftables processing, and unauthorized execution of Bluetooth management commands. Affected packages include `kernel-5.14.0-70.64.1.el9_0` for x86_64, s390x, ppc64le, and aarch64 deployments, and `kernel-rt-5.14.0-70.64.1.rt21.135.el9_0` for supported x86_64 SAP Solutions systems. One fixed issue, **CVE-2023-2235**, is a use-after-free vulnerability in the Performance Events subsystem that may allow a local attacker to escalate privileges. The defect in `perf_group_detach()` could leave a dangling pointer when `remove_on_exec` invokes `list_del_event()` before group detachment; upstream corrected it in commit `fd0815f632c24878e325821943edccc7fde947a2`. Organizations using affected RHEL 9.0 EUS systems should install the applicable updated kernel packages and reboot hosts to activate the fixes.
Aug 26, 2026
Red Hat released **RHSA-2025:2270** for RHEL 9.4 Extended Update Support, updating the kernel to `5.14.0-427.57.1.el9_4` and remediating 21 vulnerabilities across EFI, memory management, networking, Open vSwitch, ACPI, ext4, SCTP, I2C, ARM64 probes, and graphics. The update applies across supported x86_64, aarch64, ppc64le, and s390x RHEL 9.4 EUS and associated update channels. The advisory includes **CVE-2024-26843**, a medium-severity potential integer overflow in EFI runtime handling of soft-reserved region sizes, and **CVE-2024-26846**, a low-severity NVMe over Fibre Channel module-exit race that can indefinitely hang module unloading and cause a local availability impact. Upstream fixes for both issues were incorporated in Linux versions 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, and 6.8; Red Hat also delivered fixes for standard RHEL 8 and 9 kernels. Systems must be rebooted after installing the updated kernel.
Aug 26, 2026
Red Hat released **RHSA-2023:4801**, an Important security and bug-fix update for Red Hat Enterprise Linux 9.0 Extended Update Support and selected SAP Update Services channels. The `5.14.0-70.70.1.el9_0` kernel packages remediate five disclosed flaws, including an ipvlan out-of-bounds write, a PF_KEY information leak, a TLS use-after-free or NULL-pointer dereference, and the stale-TLB race tracked as **CVE-2022-39188**. That flaw can let a device driver free a page while stale TLB entries remain during a race between `unmap_mapping_range()` and `munmap()` on `VM_PFNMAP` memory areas. The update also fixes **CVE-2023-0458**, a speculative pointer-dereference issue in `do_prlimit()` that a locally authenticated low-privilege attacker could potentially use to leak kernel memory by controlling resource-related pointer arithmetic. Red Hat rated both issues moderate severity at CVSS 4.7 and did not identify a qualifying standalone mitigation; affected organizations should install the relevant kernel errata and reboot systems to load the patched kernel.
Aug 26, 2026