Loading story…
Red Hat released Important-rated kernel security updates for Red Hat Enterprise Linux 8 and 9 streams, including RHEL 9.0 Extended Update Support and associated SAP and CodeReady Linux Builder repositories. The RHEL 9.0 EUS update delivers kernel version 5.14.0-70.101.1.el9_0 for x86_64, s390x, ppc64le, and aarch64 systems.
The updates remediate multiple Linux kernel concurrency flaws, including CVE-2024-26585, a TLS asynchronous-cryptography race between transmit-work scheduling and socket closure; CVE-2024-26810, involving VFIO PCI external INTx masking operations; and CVE-2024-26686, affecting procfs thread and child-statistics collection. Administrators should apply the relevant Red Hat kernel packages across standard, EUS, SAP, telecommunications, and mission-critical support deployments, then reboot systems to activate the fixes.
See real exploitation activity before you spend the cycle.
11 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important-rated advisory RHSA-2024:3421 for RHEL 9.0 Extended Update Support, providing kernel version 5.14.0-70.101.1.el9_0. The update addressed multiple kernel flaws, including CVE-2023-6240, CVE-2024-1086, CVE-2024-26586, CVE-2024-25742, and CVE-2024-25743; affected systems require a reboot after installation.
Red Hat addressed CVE-2023-52639, a race condition during shadow creation in the Linux kernel KVM s390 VSIE component, through RHSA-2024:3855 for RHEL 9.2 EUS, RHSA-2024:4740 for RHEL 8.8 EUS, and RHSA-2024:5257 for RHEL 9.0 Update Services for SAP Solutions.
Red Hat addressed CVE-2024-36003 for Red Hat Enterprise Linux 9 through RHSA-2024:5928. The resolved Linux kernel issue involves a lock-dependency problem between LAG handling and VF operations in the Intel Ethernet Controller (ice) driver's ice_reset_vf() function.
CVE-2021-47353 affects the Linux kernel UDF filesystem's udf_symlink function, where a NULL-pointer dereference could cause a kernel crash or denial of service. Red Hat addressed the resolved upstream issue for RHEL 8 through RHSA-2024:4211 and RHSA-2024:4352.
CVE-2021-46909 affects ARM Footbridge PCI interrupt mapping: IRQ-mapping functions marked __init could be invoked after initialization when PCI drivers are loaded or bound, causing a kernel oops. Red Hat addressed the issue for RHEL 8 through RHSA-2024:4211 and RHSA-2024:4352.
Red Hat addressed CVE-2024-26686 through advisories for RHEL 8 and 9, including RHEL 8.8 and RHEL 9.2/9.4 EUS as well as specialized mission-critical, SAP, and telecommunications offerings.
CVE-2024-26686 was assigned for a Linux kernel fs/proc do_task_stat issue affecting the collection of thread and child statistics. The remediation uses sig->stats_lock while gathering the statistics.
Red Hat addressed CVE-2024-26810 in advisories covering RHEL 8 and 9, including EUS, SAP, telecommunications, and mission-critical support variants.
CVE-2024-26810 was assigned for a Linux kernel VFIO PCI subsystem issue involving external INTx masking operations. The upstream remediation locks those operations to address a potential concurrency condition.
Red Hat addressed CVE-2024-26585 through advisories for RHEL 8 and 9, including RHSA-2024:2394, RHSA-2024:4211, RHSA-2024:4352, and specialized EUS, SAP, telecommunications, and mission-critical offerings.
CVE-2024-26585 was identified as an ordering race in Linux kernel TLS asynchronous cryptographic request handling, where a submitting recvmsg/sendmsg thread can exit after completion is signaled. The upstream fix schedules work before invoking complete().
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** kernel and Real Time kernel updates for Red Hat Enterprise Linux 9.0 Extended Update Support, remediating six Linux kernel vulnerabilities. The flaws include multiple use-after-free conditions, an out-of-bounds access in XFS, a kernel-pointer information disclosure issue in nftables processing, and unauthorized execution of Bluetooth management commands. Affected packages include `kernel-5.14.0-70.64.1.el9_0` for x86_64, s390x, ppc64le, and aarch64 deployments, and `kernel-rt-5.14.0-70.64.1.rt21.135.el9_0` for supported x86_64 SAP Solutions systems. One fixed issue, **CVE-2023-2235**, is a use-after-free vulnerability in the Performance Events subsystem that may allow a local attacker to escalate privileges. The defect in `perf_group_detach()` could leave a dangling pointer when `remove_on_exec` invokes `list_del_event()` before group detachment; upstream corrected it in commit `fd0815f632c24878e325821943edccc7fde947a2`. Organizations using affected RHEL 9.0 EUS systems should install the applicable updated kernel packages and reboot hosts to activate the fixes.
Aug 26, 2026
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026