Loading story…
Red Hat released Linux kernel security updates for RHEL 8 and RHEL 9 that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include CVE-2024-41040, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; CVE-2024-26826 in Multipath TCP stale-subflow reinjection; and CVE-2024-26870, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (CVE-2024-26772), a swap race (CVE-2024-26960), a writeback divide-by-zero (CVE-2024-26720), and CacheFiles memory leakage (CVE-2024-26840).
The updates also address the WMI character-device issue tracked as CVE-2023-52864 and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including RHSA-2024:5065 for selected RHEL 8.6 channels and RHSA-2024:5363 for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
See real exploitation activity before you spend the cycle.
22 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-rated RHSA-2024:9497 for RHEL 9.2 extended-support and selected update-service channels, providing kernel version 5.14.0-284.92.1.el9_2. The update fixes 11 CVEs, including ext4, NFSv4.2, AMDGPU, TCP zero-copy, MPTCP, and IUCV flaws, and requires affected systems to be rebooted.
Red Hat updated its RHSA-2024:5363 RHEL 9 kernel security advisory.
Red Hat issued Important-rated RHSA-2024:5363 for RHEL 9 kernel packages across supported architectures and service channels. The update remediated numerous flaws, including CVE-2023-52864, and requires a reboot to take effect.
Red Hat issued the Moderate-rated RHSA-2024:5065 kernel update for selected RHEL 8.6 support channels. The update included fixes for CVE-2024-26826, CVE-2024-26870, and ten other kernel vulnerabilities; affected systems require a reboot after installation.
The Linux kernel CVE team assigned CVE-2024-26960 for a swap-subsystem race between free_swap_and_cache() and swapoff().
The Linux kernel CVE team assigned CVE-2024-26870 and the NFSv4.2 nfs4_listxattr issue was reported resolved. The flaw could trigger a kernel BUG at mm/usercopy.c:102.
Robb Gatica reported CVE-2024-26840, a CacheFiles memory leak in cachefiles_add_cache().
The Linux kernel CVE team assigned CVE-2024-26804 for an issue in net/ip_tunnel that could cause perpetual headroom growth. The issue was resolved upstream with the fix “net: ip_tunnel: prevent perpetual headroom growth,” and Red Hat later addressed it across RHEL 8 and RHEL 9 product variants.
The Linux kernel upstream advisory reported CVE-2024-26759 resolved with the patch “mm/swap: fix race when skipping swapcache.” The vulnerability is a race condition in swap and swapcache handling; Red Hat later addressed it for RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support.
The Linux kernel resolved CVE-2024-26907 with the fix “RDMA/mlx5: Fix fortify source warning while accessing Eth segment.” Red Hat addressed the low-impact RDMA/mlx5 issue through advisories for RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support.
The Linux kernel resolved CVE-2024-26906 by disallowing copy_from_kernel_nofault() from reading the x86 vsyscall page. Red Hat addressed the issue for RHEL 8, RHEL 9, and specified RHEL 9 Extended Update Support releases through multiple 2024 advisories.
The Linux kernel resolved CVE-2024-41012 by reliably removing locks when a race between fcntl and close operations is detected. Red Hat addressed the flaw in RHEL 8 via RHSA-2024:7000 and RHSA-2024:7001, and in RHEL 9 via RHSA-2024:9315.
The Linux kernel fixed CVE-2024-40958 by making get_net_ns() use maybe_get_net(), preventing references to network namespaces whose reference count has reached zero. Red Hat addressed the issue in RHEL 9 through RHSA-2024:5363 and in RHEL 8 through RHSA-2024:7000 and RHSA-2024:7001.
The Linux kernel resolved CVE-2024-26973 with the fix “fat: fix uninitialized field in nostale filehandles.” Red Hat listed fixes for RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support.
Red Hat listed security advisories addressing CVE-2024-26960 for RHEL 8, RHEL 9, and RHEL 9.4 Extended Update Support. The issue is the race between free_swap_and_cache() and swapoff().
The upstream remediation for CVE-2024-41040 retrieves the conntrack entry from the socket buffer again after conntrack confirmation, preventing a freed entry from reaching tcf_ct_flow_table_process_conn. Red Hat listed fixes for RHEL 8, RHEL 9, and selected Extended Update Support releases.
The Linux kernel resolved CVE-2024-26720 with a fix for a possible divide-by-zero condition in wb_dirty_limits(). Red Hat listed remediation for RHEL 8, RHEL 9, and relevant Extended Update Support releases.
The Linux kernel fixed CVE-2024-26840, a memory leak in cachefiles_add_cache(), in kernel versions from 4.19.309 through 6.8. Red Hat also listed security and bug-fix advisories for affected RHEL releases.
The Linux kernel resolved CVE-2024-26826 with the fix “mptcp: fix data re-injection from stale subflow.” Red Hat listed fixes for RHEL 8 and RHEL 9 product variants.
CVE-2023-52864 in the kernel platform/x86 WMI component was resolved by correcting character-device opening behavior. Red Hat listed remediation across RHEL 8, RHEL 9, and several extended-support offerings.
The upstream remediation for CVE-2024-26772 changed ext4_mb_find_by_goal() to avoid allocating blocks from corrupted block groups. Red Hat subsequently listed fixes for RHEL 8, RHEL 9, and specialized support variants.
The Linux kernel resolved CVE-2024-40928 in ethtool_get_phy_stats_ethtool() by returning -EOPNOTSUPP when ops->get_ethtool_phy_stats is unavailable, preventing a null-pointer function call. Red Hat addressed the flaw in RHEL 9 through RHSA-2024:5363.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
19 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for supported **RHEL 8 and RHEL 9** streams, addressing dozens of flaws across networking, virtualization, storage, graphics, Bluetooth, filesystems, and device drivers. The updates include **CVE-2024-36886**, a TIPC message-reassembly use-after-free issue that could permit remote code execution on affected RHEL 8.6 systems, as well as memory-corruption, information-disclosure, race-condition, denial-of-service, and NULL-pointer defects. RHEL 9.2 updates delivered kernel `5.14.0-284.75.1.el9_2`, while RHEL 8.8 and 8.6 updates provided `4.18.0-477.64.1.el8_8` and `4.18.0-372.111.1.el8_6`, respectively; Real Time kernel users received `5.14.0-284.75.1.rt14.360.el9_2`. The fixes cover, among other issues, **CVE-2024-35791**, a KVM SVM use-after-free in `svm_register_enc_region()`, **CVE-2024-36952**, a race condition in the SCSI `lpfc` driver's NPIV cleanup sequence, and **CVE-2024-27417**, an IPv6 reference leak in `inet6_rtm_getaddr()`. Red Hat shipped remediation through RHSA-2024:4823, RHSA-2024:4831, RHSA-2024:4740, RHSA-2024:4447, RHSA-2024:0113, and RHSA-2024:6567 for affected x86_64, ARM64, IBM Z, and Power offerings, including EUS, SAP, and extended-lifecycle channels. Organizations should apply the applicable kernel packages and **reboot systems** to activate the fixes.
Aug 26, 2026
Red Hat released Important-rated RHEL 9 kernel and real-time kernel updates that remediate a broad set of Linux kernel vulnerabilities across networking, traffic control, XFRM, IPv6, USB, Wi-Fi, memory management, and virtualization components. The updates include `kernel-rt-5.14.0-284.11.1.rt14.296.el9_2` for x86_64 and corresponding standard kernel packages for x86_64, s390x, ppc64le, and aarch64 RHEL 9 deployments, including EUS, ELS, SAP, AUS, and CodeReady variants. Notable fixes include races and memory-safety flaws tracked as `CVE-2022-3028`, `CVE-2022-3567`, `CVE-2022-3522`, `CVE-2022-4129`, `CVE-2022-43750`, `CVE-2022-47929`, `CVE-2023-0394`, and `CVE-2023-0590`. Impacts range from local denial of service and kernel-information disclosure to potential privilege escalation; `CVE-2022-3628` can be triggered through a malicious USB device against the `brcmfmac` Wi-Fi driver. Organizations should apply the applicable supported RHEL kernel errata, reboot systems to activate the new kernel, and, where patching `CVE-2022-3628` is not immediately possible, prevent loading the `brcmfmac` module.
Aug 26, 2026
Red Hat released kernel security updates for multiple RHEL 8.2, 8.8, 9.2, and 10 lifecycle, SAP, telecommunications, and extended-support offerings. The advisories address vulnerabilities including USB DWC3 gadget event-buffer bounds handling (`CVE-2025-37810`), SunRPC TLS-alert processing (`CVE-2025-38566`), VKMS/DRM use-after-free and double-free conditions (`CVE-2025-22097`), UDP memory-accounting leaks (`CVE-2025-22058`), RDMA/IWCM use-after-free (`CVE-2025-38211`), POSIX CPU-timer races (`CVE-2025-38352`), and a `sch_qfq` scheduler race (`CVE-2025-38477`). Additional fixes cover ext4 attributes, IPv6 multicast, MD RAID10, TIPC, Intel i40e MMIO access, vsock TOCTOU handling, netfilter conntrack removal, SMB oplocks, and DRM/GEM framebuffer references. Affected organizations should deploy the applicable updated packages, including RHEL 9.2 kernel `5.14.0-284.137.1.el9_2`, RHEL 9.2 real-time kernel `5.14.0-284.140.1.rt14.425.el9_2`, and RHEL 8.2 AUS kernel `4.18.0-193.168.1.el8_2`. The updates apply across supported x86_64, ARM64, ppc64le, and s390x offerings where listed; systems must be rebooted after installation for the patched kernel to become active.
Aug 26, 2026