Loading story…
Red Hat released fixes across supported RHEL 8 and RHEL 9 streams for a set of Linux kernel flaws affecting networking, device drivers, USB Type-C, x86 machine-check handling, and the block layer. The remediated issues include CVE-2024-36929, where handling SKB_GSO_FRAGLIST packets through skb_copy or skb_copy_expand could yield invalid packets and subsequently crash the kernel; Red Hat rated it Moderate (CVSS 3.1 5.5). Other Moderate-rated issues include an integer overflow in blk_ioctl_discard() (CVE-2024-36917) and a potential uninitialized-value access in IPv6 __ip6_make_skb() (CVE-2024-36903).
Additional fixes address rtnetlink nested VLAN attribute validation (CVE-2024-36017), bonding setup, atl1c DMA receive overflow handling, mlxsw ACL TCAM list handling, and Intel igb firmware-version string truncation, as well as null-pointer, buffer-sizing, and read-limit defects in rtw89 and ath11k Wi-Fi drivers and the UCSI USB Type-C subsystem. Most require local access or concern specialized hardware and were assessed as Low to Moderate impact; the references report no exploitation in the wild. Organizations should apply the applicable Red Hat kernel and kernel-rt advisories, including Extended Update Support and specialized RHEL channels where deployed. CVE-2024-35876, concerning x86 MCE locking, was later rejected by the upstream Linux kernel CVE process despite having been tracked and patched in Red Hat advisories.
See real exploitation activity before you spend the cycle.
19 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:5101 and RHSA-2024:5102 for RHEL 8 kernel and kernel-rt packages, addressing CVE-2024-36017 and CVE-2024-36929.
Red Hat released RHSA-2024:5066 and RHSA-2024:5067 for RHEL 9.2 Extended Update Support, addressing CVE-2024-36017 and CVE-2024-36929 in kernel and kernel-rt packages.
Red Hat released RHSA-2024:4902 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions, fixing CVE-2024-36929.
An upstream Linux kernel CVE advisory was issued for CVE-2023-52784, a bonding-subsystem issue fixed by stopping the device in bond_setup_by_slave().
The Linux kernel CVE team assigned CVE-2024-36006 to an incorrect list API usage issue in the mlxsw Spectrum ACL TCAM component.
An upstream Linux kernel CVE advisory for CVE-2024-35938 was published. The issue in the ath11k Wi-Fi driver was fixed by reducing the MHI channel buffer length to 8 KB.
The upstream Linux kernel CVE process rejected CVE-2024-35876, which had been assigned to an x86 machine-check exception locking issue in set_bank().
Red Hat released RHSA-2024:6993, fixing CVE-2024-36929 for RHEL 8.8 Extended Update Support.
Red Hat released RHSA-2024:6206, fixing CVE-2024-36017 for RHEL 8.8 Extended Update Support.
Red Hat released RHSA-2024:5363 for RHEL 9, addressing CVE-2024-36017 and CVE-2024-36929.
Red Hat released RHSA-2024:5281, fixing CVE-2024-36017 for RHEL 8.6 Advanced Mission Critical Update Support, Telecommunications Update Service, and Update Services for SAP Solutions.
The Linux kernel fixed CVE-2024-36929 by making skb_copy and skb_copy_expand reject SKB_GSO_FRAGLIST packets. Processing improperly linearized packets could subsequently crash the kernel and cause denial of service.
The Linux kernel resolved CVE-2024-36917, an integer overflow in the block-layer blk_ioctl_discard() function.
The Linux kernel resolved CVE-2024-36903, a potential uninitialized-value access in the IPv6 __ip6_make_skb() function.
The Linux kernel corrected validation of nested IFLA_VF_VLAN_LIST attributes for CVE-2024-36017. The flaw could allow an undersized attribute to be treated as ifla_vf_vlan_info and later cause an out-of-bounds read.
The Linux kernel resolved CVE-2024-36010 by fixing string-truncation warnings in the igb_set_fw_version function of the Intel igb network driver.
The Linux kernel fixed CVE-2024-35946, a null-pointer access in the rtw89 Wi-Fi driver that can occur when a scan is aborted.
The Linux kernel resolved CVE-2024-35924 in the USB Type-C UCSI component by limiting read size for UCSI version 1.2.
The Linux kernel addressed a DMA receive-overflow issue in the atl1c network driver, tracked as CVE-2023-52834, by adding a workaround for the overflow condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
14 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released Linux kernel security updates for **RHEL 8** and **RHEL 9** that remediate vulnerabilities across networking, filesystems, memory management, and platform components. The fixes include `CVE-2024-41040`, a use-after-free in the traffic-control connection-tracking path triggered after a conntrack clash; `CVE-2024-26826` in Multipath TCP stale-subflow reinjection; and `CVE-2024-26870`, which can trigger a kernel BUG in NFSv4.2 extended-attribute handling. Other remediated issues include an ext4 corrupted-block-group allocation flaw (`CVE-2024-26772`), a swap race (`CVE-2024-26960`), a writeback divide-by-zero (`CVE-2024-26720`), and CacheFiles memory leakage (`CVE-2024-26840`). The updates also address the WMI character-device issue tracked as `CVE-2023-52864` and additional kernel defects affecting areas such as TCP, Wi-Fi, VFIO, storage, drivers, IPv6, virtualization, and Netfilter. Red Hat distributed fixes through advisories including **RHSA-2024:5065** for selected RHEL 8.6 channels and **RHSA-2024:5363** for RHEL 9, covering supported architectures and selected EUS, SAP, telecommunications, mission-critical, and lifecycle support variants. Organizations should deploy the applicable updated kernel packages and reboot affected systems to activate the fixes.
Aug 26, 2026
Red Hat released **RHSA-2023:6901**, an Important security update for the `kernel-rt` package in Red Hat Enterprise Linux 8. The update affects RHEL for Real Time 8, Real Time for NFV 8, and RHEL for x86_64 Extended Life Cycle 8.10, remediating a broad set of kernel memory-safety, race-condition, denial-of-service, information-disclosure, and speculative-execution weaknesses. Organizations should install the applicable updated kernel package and reboot affected hosts for the protections to take effect. Notable issues addressed across the associated RHEL errata include `CVE-2023-31436`, an out-of-bounds access in traffic-control QFQ that can enable local privilege escalation; `CVE-2023-1998`, which can defeat Spectre v2 speculation protections between SMT sibling threads; and Bluetooth L2CAP flaws `CVE-2022-3640` and `CVE-2022-42895`, involving use-after-free and kernel-pointer disclosure. Other fixes cover double-free, buffer-overflow, and device-driver vulnerabilities, including `CVE-2023-1079` in the ASUS HID driver and `CVE-2023-26545` in MPLS. Where patching cannot be immediate, Red Hat documents limited mitigations such as preventing the `usb_8dev` module or affected ASUS HID driver from loading; however, applying the relevant security errata remains the recommended remediation.
Aug 26, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026