Loading story…
Red Hat released Important kernel and real-time kernel updates for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, delivering kernel version 5.14.0-70.105.1.el9_0 for x86_64, ppc64le, aarch64, and s390x, and kernel-rt version 5.14.0-70.105.1.rt21.177.el9_0 for x86_64. The updates remediate CVE-2024-0193, a Netfilter use-after-free vulnerability in which local unprivileged users could potentially escalate privileges by triggering double deactivation during pipapo-set removal and catchall-element garbage collection.
The advisories also address CVE-2023-52434, an SMB client out-of-bounds flaw caused by inadequate validation of SMB2 create-context offsets and lengths; Red Hat rates it 5.9 CVSS and considers adjacent-network denial of service the most likely impact. The standard kernel update additionally fixes a KVM use-after-free issue and a Netfilter protocol-number sanitization weakness, while the real-time update includes the latter Netfilter flaw. Administrators should apply the applicable packages and reboot affected systems for the fixes to take effect; preventing the cifs module from loading can mitigate the SMB issue until patching is complete.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2024:6991 for RHEL 9.0 Update Services for SAP Solutions, delivering kernel version 5.14.0-70.117.1.el9_0. The update fixes 12 CVEs, including CVE-2023-52489, CVE-2024-40995, CVE-2024-41055, and CVE-2024-41071, and requires affected systems to be rebooted.
Red Hat issued an Important kernel update for RHEL 9.0 Update Services for SAP Solutions, providing kernel version 5.14.0-70.105.1.el9_0. The update remediates CVE-2024-0193, CVE-2023-52434, CVE-2024-26598, and CVE-2024-26673, and requires a reboot to take effect.
Red Hat issued an Important kernel-rt update for RHEL 9.0 Update Services for SAP Solutions on x86_64. Version 5.14.0-70.105.1.rt21.177.el9_0 fixes CVE-2024-0193, CVE-2023-52434, and CVE-2024-26673; systems require a reboot after installation.
Red Hat released RHSA-2024:2950 for RHEL 8 kernel-rt and RHSA-2024:3138 for the RHEL 8 kernel, remediating CVE-2023-52434.
Red Hat released RHSA-2024:2394 to fix CVE-2023-52434, an out-of-bounds condition in the Linux SMB client's smb2_parse_contexts() function, for Red Hat Enterprise Linux 9.
Mauro Matteo Cascella reported the Linux kernel Netfilter flaw later tracked as CVE-2024-0193. The bug can double-deactivate a catchall element during pipapo set removal, causing use-after-free and possible local privilege escalation.
Red Hat released RHSA-2024:6993 to fix CVE-2023-52434 in the RHEL 8.8 Extended Update Support kernel stream.
RHSA-2024:5692 remediated CVE-2023-52434 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
An upstream Netfilter fix was made available in commit 7315dc1e122c85ffdfc8defffbb8f8b616c2eb1a, and Fedora fixed CVE-2024-0193 in Linux 6.6.10 stable kernel updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2024:6990**, an Important security update for the real-time kernel on Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions on x86_64. The update delivers `kernel-rt-5.14.0-70.117.1.rt21.189.el9_0`, addressing 11 Linux kernel vulnerabilities across sparse-memory handling, networking, ACPICA, RDMA, vsock, perf, SUNRPC, and mac80211 Wi-Fi components. Red Hat did not report active exploitation of the flaws. Notable fixes include **CVE-2023-52489**, a locally exploitable sparse-memory race condition that can compromise availability through denial of service when compaction processes device-memory PFNs, and **CVE-2024-40995**, which can trigger an infinite loop and system-wide task hangs in the traffic-control action API when multiple actions use the same index. The advisory also includes a fix for **CVE-2021-47393** affecting the `mlxreg-fan` hardware-monitoring driver. Administrators should install the updated kernel-rt package and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released Moderate-severity Linux kernel security updates for RHEL 9.0 SAP Solutions, RHEL 9.2 SAP and associated offerings, and RHEL 10/10.2 variants. The advisories remediate vulnerabilities in networking, HID, SCTP, ALSA audio, RDMA, KVM, event polling, TLS, cryptographic, and Wi-Fi code, including buffer overflows, use-after-free conditions, and recursion that could exhaust kernel resources. Key fixes include `CVE-2025-38614` in eventpoll, `CVE-2025-39864` in cfg80211, `CVE-2025-39903` affecting NUMA memory-node handling, and `CVE-2025-39946` in TLS stream handling. Affected organizations should deploy the applicable kernel packages—`5.14.0-70.151.1.el9_0` for RHEL 9.0 SAP, `5.14.0-70.151.1.rt21.223.el9_0` for its real-time kernel, and `5.14.0-284.144.1.el9_2` for RHEL 9.2 SAP—across x86_64, aarch64, ppc64le, and s390x systems as applicable. Red Hat requires a reboot after installation for mitigations to take effect; its kernel maintenance also includes a resolved Intel SOF HDA issue, `CVE-2022-50050`, where unsafe handling of `snprintf()` output could lead to a buffer overflow.
Aug 26, 2026
Red Hat released kernel security updates for Red Hat Enterprise Linux (RHEL) 9 and 10, including a Real Time kernel update for RHEL 9.2 SAP-related lifecycle channels. The advisories remediate memory-safety and stability flaws including out-of-bounds accesses, use-after-free conditions, race conditions, NULL-pointer dereferences, and command-header validation issues. Affected components span the audit subsystem, HID multitouch, SCTP, NFS, SMB, Bluetooth, RDMA, SCSI, TLS, USB DWC3, libceph, and networking memory-management paths. Notable fixes include `CVE-2025-39840`, an out-of-bounds read in `audit_compare_dname_path()` that can occur when an audit watch on `/` processes a one-character child path, and `CVE-2025-39883`, which could let a local user with access to the hwpoison debugfs interface trigger a kernel panic through invalid memory unpoisoning. Later RHEL 9.2 SAP update `5.14.0-284.161.1.el9_2` also addresses `CVE-2025-38129` and `CVE-2025-38154` use-after-free flaws, with the BPF sockmap issue potentially enabling denial of service or privilege escalation. Administrators should deploy the applicable updated kernel packages and reboot systems to activate the fixes.
Aug 26, 2026